verify signature at runtime not gentime

1 files changed, 8 insertions, 3 deletions

diff --git a/tpm2_hook b/tpm2_hook
index 3f6b832..2acab94 100755
--- a/tpm2_hook
+++ b/tpm2_hook
@@ -9,14 +9,18 @@ run_hook() {
 
 	policy="/etc/tpm2/policy"
 	rsaname="/etc/tpm2/rsaname"
-	verification="/etc/tpm2/verification"
+	rsapub="/etc/tpm2/rsapub"
+	rsasig="/etc/tpm2/rsasig"
+	rsactx="/etc/tpm2/rsactx"
 
 	pcr=$(cat /etc/tpm2/pcr)
 	keyloc=$(cat /etc/tpm2/keyloc)
 
-	tpmdev="/dev/tpmrm0"
-
 	session="/session.ctx"
+	verification="/verification.tkt"
+
+	tpm2_loadexternal -G rsa -C o -u $rsapub -c $rsactx -n $rsaname 1> /dev/null
+	tpm2_verifysignature -c $rsactx -g sha256 -m $policy -s $rsasig -t $verification -f rsassa 1> /dev/null
 
 	tpm2_startauthsession --policy-session -S $session 1> /dev/null
 	tpm2_policypcr -l $pcr -S $session 1> /dev/null
@@ -30,6 +34,7 @@ run_hook() {
 	tpm2_flushcontext $session 1> /dev/null
 
 	rm -f $session
+	rm -f $verification
 
 	tpmok=0
 	if [ $unseal -eq 0 ]; then