[PATCH] tpm: Don't propagate measurement failures to the verifiers layer

[Javier Martinez Canillas]

Currently if an EFI firmware fails to do a TPM measurement for a file, the
error will be propagated to the verifiers framework which will prevent it
to be opened.

This mean that buggy firmwares will lead to the system not booting because
files won't be allowed to be loaded. But a failure to do a TPM measurement
isn't expected to be a fatal error that causes the system to be unbootable.

To avoid this, don't return errors from .write and .verify_string callbacks
and just print a debug message in the case of a TPM measurement failure.

Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
---

 grub-core/commands/tpm.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/grub-core/commands/tpm.c b/grub-core/commands/tpm.c
index 2052c36eaba..24874ffacbc 100644
--- a/grub-core/commands/tpm.c
+++ b/grub-core/commands/tpm.c
@@ -42,7 +42,11 @@ grub_tpm_verify_init (grub_file_t io,
 static grub_err_t
 grub_tpm_verify_write (void *context, void *buf, grub_size_t size)
 {
-  return grub_tpm_measure (buf, size, GRUB_BINARY_PCR, context);
+  grub_err_t status = grub_tpm_measure (buf, size, GRUB_BINARY_PCR, context);
+
+  if (status)
+    grub_dprintf ("tpm", "Measuring buffer failed: %d\n", status);
+  return GRUB_ERR_NONE;
 }
 
 static grub_err_t
@@ -66,15 +70,17 @@ grub_tpm_verify_string (char *str, enum 
grub_verify_string_type type)
     }
   description = grub_malloc (grub_strlen (str) + grub_strlen (prefix) + 1);
   if (!description)
-    return grub_errno;
+    return GRUB_ERR_NONE;
   grub_memcpy (description, prefix, grub_strlen (prefix));
   grub_memcpy (description + grub_strlen (prefix), str,
               grub_strlen (str) + 1);
   status =
     grub_tpm_measure ((unsigned char *) str, grub_strlen (str),
                      GRUB_STRING_PCR, description);
+  if (status)
+    grub_dprintf ("tpm", "Measuring string %s failed: %d\n", str, status);
   grub_free (description);
-  return status;
+  return GRUB_ERR_NONE;
 }
 
 struct grub_file_verifier grub_tpm_verifier = {
-- 
2.29.2