"LD_PRELOAD something that gives it the desired response, or hack it so it ignores failure. It's just far too easy to circumvent."
Binding a secret to PCR state will let you rely on the TPM to do the actual enforcement. If you're just checking PCR values in the TPM and testing a return code, the hardware isn't enforcing, you're just doing a software check - why use a TPM at all?
Power management, mobile and firmware developer on Linux. Security developer at nvidia. Ex-biologist. Content here should not be interpreted as the opinion of my employer. Also on Mastodon and Bluesky.
![[personal profile]](https://www.dreamwidth.org/img/silk/identity/user.png){kind=small}
Let the TPM do the enforcement...
Date: 2013-05-08 12:38 am (UTC)Binding a secret to PCR state will let you rely on the TPM to do the actual enforcement. If you're just checking PCR values in the TPM and testing a return code, the hardware isn't enforcing, you're just doing a software check - why use a TPM at all?
Good write up. :-)
Kent Yoder