From: James Bottomley <James.Bottomley@HansenPartnership.com> To: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>, linux-integrity@vger.kernel.org Cc: Mimi Zohar <zohar@linux.ibm.com>, David Woodhouse <dwmw2@infradead.org>, keyrings@vger.kernel.org, David Howells <dhowells@redhat.com> Subject: Re: [PATCH v9 0/8] TPM 2.0 trusted keys with attached policy Date: Fri, 15 May 2020 03:44:23 +0000 [thread overview] Message-ID: <1589514263.5759.25.camel@HansenPartnership.com> (raw) In-Reply-To: <483c4f1af7be41c8d091b11d4484b606ebd319b7.camel@linux.intel.com> On Fri, 2020-05-15 at 05:22 +0300, Jarkko Sakkinen wrote: > On Thu, 2020-05-14 at 17:31 +0300, Jarkko Sakkinen wrote: > > I'm compiling now kernel with all series included. > > > > Kind of checking if I could just take the whole series. Let see. > > > > In all cases I want the style errors in 3/8 to be fixes with a > > helper > > but maybe better to hold before sending anything. Possibly that is > > all > > needed I'll just carve that patch myself. > > > > Please don't do anything for the moment. > > This is what I tried first (with the full series applied): > > #!/bin/sh > > die() > { > keyctl clear @u > ./tpm2-flush --all-transient > exit $1 > } > > KEYHANDLE=$(./tpm2-root-key || die 1) > KEYID=$(keyctl add trusted kmk "new 32 keyhandle=$KEYHANDLE > hash=sha256" @u || die 1) > > echo "$KEYID ($KEYHANDLE)" > > keyctl pipe $KEYID > blob.hex || die 1 > keyctl clear @u || die 1 > > echo "Import key from blob" > > keyctl add trusted kmk "load `cat blob.hex` keyhandle=$KEYHANDLE" @u > || die 1 > > die 0 > > Result: > > sudo ./keyctl-smoke.sh > 566201053 (0x80000000) > keyctl_read_alloc: Permission denied Well, it's clearly failing in keyctl pipe I do confess to never having tested a volatile primary, but I just did so and it works for me. I will also add the keyhandle in the load isn't necessary, because it should be in the blob, but there should also be no harm (just tested). However, I don't have keyctl_read_alloc in my tree, so it may be an incompatibility with another patch set. What's your base and what other patches do you have applied? James > Any ideas what I might have done wrong? Have not tried auth value yet > but afaik the above should fully test import and export. > > Uses tpm2-scripts: > > https://github.com/jsakkine-intel/tpm2-scripts > > I'll probably move these to git.infradead.org because I don't like > really like at all Github and my kernel tree is there anyway. > > /Jarkko >
WARNING: multiple messages have this Message-ID (diff)
From: James Bottomley <James.Bottomley@HansenPartnership.com> To: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>, linux-integrity@vger.kernel.org Cc: Mimi Zohar <zohar@linux.ibm.com>, David Woodhouse <dwmw2@infradead.org>, keyrings@vger.kernel.org, David Howells <dhowells@redhat.com> Subject: Re: [PATCH v9 0/8] TPM 2.0 trusted keys with attached policy Date: Thu, 14 May 2020 20:44:23 -0700 [thread overview] Message-ID: <1589514263.5759.25.camel@HansenPartnership.com> (raw) In-Reply-To: <483c4f1af7be41c8d091b11d4484b606ebd319b7.camel@linux.intel.com> On Fri, 2020-05-15 at 05:22 +0300, Jarkko Sakkinen wrote: > On Thu, 2020-05-14 at 17:31 +0300, Jarkko Sakkinen wrote: > > I'm compiling now kernel with all series included. > > > > Kind of checking if I could just take the whole series. Let see. > > > > In all cases I want the style errors in 3/8 to be fixes with a > > helper > > but maybe better to hold before sending anything. Possibly that is > > all > > needed I'll just carve that patch myself. > > > > Please don't do anything for the moment. > > This is what I tried first (with the full series applied): > > #!/bin/sh > > die() > { > keyctl clear @u > ./tpm2-flush --all-transient > exit $1 > } > > KEYHANDLE=$(./tpm2-root-key || die 1) > KEYID=$(keyctl add trusted kmk "new 32 keyhandle=$KEYHANDLE > hash=sha256" @u || die 1) > > echo "$KEYID ($KEYHANDLE)" > > keyctl pipe $KEYID > blob.hex || die 1 > keyctl clear @u || die 1 > > echo "Import key from blob" > > keyctl add trusted kmk "load `cat blob.hex` keyhandle=$KEYHANDLE" @u > || die 1 > > die 0 > > Result: > > sudo ./keyctl-smoke.sh > 566201053 (0x80000000) > keyctl_read_alloc: Permission denied Well, it's clearly failing in keyctl pipe I do confess to never having tested a volatile primary, but I just did so and it works for me. I will also add the keyhandle in the load isn't necessary, because it should be in the blob, but there should also be no harm (just tested). However, I don't have keyctl_read_alloc in my tree, so it may be an incompatibility with another patch set. What's your base and what other patches do you have applied? James > Any ideas what I might have done wrong? Have not tried auth value yet > but afaik the above should fully test import and export. > > Uses tpm2-scripts: > > https://github.com/jsakkine-intel/tpm2-scripts > > I'll probably move these to git.infradead.org because I don't like > really like at all Github and my kernel tree is there anyway. > > /Jarkko >
next prev parent reply other threads:[~2020-05-15 3:44 UTC|newest] Thread overview: 65+ messages / expand[flat|nested] mbox.gz Atom feed top 2020-05-07 23:11 [PATCH v9 0/8] TPM 2.0 trusted keys with attached policy James Bottomley 2020-05-07 23:11 ` James Bottomley 2020-05-07 23:11 ` [PATCH v9 1/8] lib: add ASN.1 encoder James Bottomley 2020-05-07 23:11 ` James Bottomley 2020-05-17 8:17 ` Sakkinen, Jarkko 2020-05-17 8:17 ` Sakkinen, Jarkko 2020-05-07 23:11 ` [PATCH v9 2/8] oid_registry: Add TCG defined OIDS for TPM keys James Bottomley 2020-05-07 23:11 ` James Bottomley 2020-05-07 23:11 ` [PATCH v9 3/8] security: keys: trusted: fix TPM2 authorizations James Bottomley 2020-05-07 23:11 ` James Bottomley 2020-05-14 1:11 ` Jarkko Sakkinen 2020-05-14 1:11 ` Jarkko Sakkinen 2020-05-14 1:12 ` Jarkko Sakkinen 2020-05-14 1:12 ` Jarkko Sakkinen 2020-05-14 1:41 ` James Bottomley 2020-05-14 1:41 ` James Bottomley 2020-05-14 11:19 ` Jarkko Sakkinen 2020-05-14 11:19 ` Jarkko Sakkinen 2020-05-07 23:11 ` [PATCH v9 4/8] security: keys: trusted: use ASN.1 TPM2 key format for the blobs James Bottomley 2020-05-07 23:11 ` James Bottomley 2020-05-17 8:18 ` Sakkinen, Jarkko 2020-05-17 8:18 ` Sakkinen, Jarkko 2020-05-07 23:11 ` [PATCH v9 5/8] security: keys: trusted: Make sealed key properly interoperable James Bottomley 2020-05-07 23:11 ` James Bottomley 2020-05-07 23:11 ` [PATCH v9 6/8] security: keys: trusted: add PCR policy to TPM2 keys James Bottomley 2020-05-07 23:11 ` James Bottomley 2020-05-07 23:11 ` [PATCH v9 7/8] security: keys: trusted: add ability to specify arbitrary policy James Bottomley 2020-05-07 23:11 ` James Bottomley 2020-05-07 23:11 ` [PATCH v9 8/8] security: keys: trusted: implement counter/timer policy James Bottomley 2020-05-07 23:11 ` James Bottomley 2020-05-14 14:31 ` [PATCH v9 0/8] TPM 2.0 trusted keys with attached policy Jarkko Sakkinen 2020-05-14 14:31 ` Jarkko Sakkinen 2020-05-15 2:22 ` Jarkko Sakkinen 2020-05-15 2:22 ` Jarkko Sakkinen 2020-05-15 3:44 ` James Bottomley [this message] 2020-05-15 3:44 ` James Bottomley 2020-05-15 8:47 ` Jarkko Sakkinen 2020-05-15 8:47 ` Jarkko Sakkinen 2020-05-15 9:30 ` Jerry Snitselaar 2020-05-15 9:30 ` Jerry Snitselaar 2020-05-15 18:48 ` James Bottomley 2020-05-15 18:48 ` James Bottomley 2020-05-16 12:24 ` Jarkko Sakkinen 2020-05-16 12:24 ` Jarkko Sakkinen 2020-05-16 9:59 ` Jarkko Sakkinen 2020-05-16 9:59 ` Jarkko Sakkinen 2020-05-15 19:17 ` Jerry Snitselaar 2020-05-15 19:17 ` Jerry Snitselaar 2020-05-15 19:34 ` James Bottomley 2020-05-15 19:34 ` James Bottomley 2020-05-15 19:50 ` Mimi Zohar 2020-05-15 19:50 ` Mimi Zohar 2020-05-15 20:10 ` James Bottomley 2020-05-15 20:10 ` James Bottomley 2020-05-15 21:03 ` Kayaalp, Mehmet 2020-05-15 22:19 ` James Bottomley 2020-05-15 22:19 ` James Bottomley 2020-05-15 23:23 ` James Bottomley 2020-05-15 23:23 ` James Bottomley 2020-05-16 21:44 ` Jarkko Sakkinen 2020-05-16 21:44 ` Jarkko Sakkinen 2020-05-16 13:01 ` Sakkinen, Jarkko 2020-05-16 13:01 ` Sakkinen, Jarkko 2020-05-16 12:33 ` Jarkko Sakkinen 2020-05-16 12:33 ` Jarkko Sakkinen
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=1589514263.5759.25.camel@HansenPartnership.com \ --to=james.bottomley@hansenpartnership.com \ --cc=dhowells@redhat.com \ --cc=dwmw2@infradead.org \ --cc=jarkko.sakkinen@linux.intel.com \ --cc=keyrings@vger.kernel.org \ --cc=linux-integrity@vger.kernel.org \ --cc=zohar@linux.ibm.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.