❦ 21 August 2021 17:45 +01, Colin Watson:
>> > We think that TPM support is a good addition to Debian because it can
>> > increase
>> > its adoption in environments where a more secure approach to the booting is
>> > needed, by being able to securely measure if any component has been
>> > tampered.
>>
>> It seems that Grub in Debian has now TPM support as there is a tpm.mod
>> shipped with Grub. Manual here:
>> https://www.gnu.org/software/grub/manual/grub/html_node/Measured-Boot.html
>>
>> The documentation suggests the module should be builtin. If not, it is a
>> bit unknown what can happen. Maybe the tpm.mod itself can be tampered?
>>
>> Would it be possible to have the module builtin for GRUB UEFI (where
>> the size does not matter)?
>
> It already is, in bullseye:
>
> grub2 (2.04-18) unstable; urgency=medium
>
> [ Steve McIntyre ]
> * Enable the shim_lock and tpm modules for i386-efi too. Ensure that
> tpm is included in our EFI images.
> [...]
>
> -- Colin Watson <cjwat...@debian.org> Sun, 25 Apr 2021 16:20:17 +0100
>
> Do we think that's enough to close this bug?
Does this mean it's inside "core.efi"? I think this is not the case:
there is a "tpm.mod" file and "strings core.efi | grep tpm" does not
return any result. But maybe it's easy for a user to build a core.efi
with the module added? Some users may like core.efi to be signed, but
that's not my case.
--
Consider well the proportions of things. It is better to be a young June-bug
than an old bird of paradise.
-- Mark Twain, "Pudd'nhead Wilson's Calendar"
