Jarkko Sakkinen <jarkko.sakkinen-VuQAYsv1563Yd54FQh9/CA@public.gmane.org>
wrote on 01/26/2016 09:50:57 PM:

=
> 
> On Wed, Jan 20, 2016 at 10:01:38PM -0500, Stefan Berger wrote=
:
> > > Except that isn't good enough - the IMA kernel side doe=
sn't
knowthat this
> > > tpm is now acting as the 'main' 'default' T=
PM.
> > 
> > Hooking the vTPM to IMA requires another pat=
ch that I haven't

> shown since IMA
> > namespacing isn't public yet. Basical=
ly we implement another
ioctl
> () that is to
> > be called before the clone() in or=
der to 'reserve' a vtpm device

> pair for the
> > calling process. During the clone() call=
 IMA namespacing code
can query the
> > vTPM driver for a 'reserved' device pair. Hookin=
g IMA up after
the
> clone() may
> > also work but in case of docker/golang=
 it's better to do this

> before since the
> > language libraries do a lot after th=
e clone automatically.
> 
> Can we expect that "in the end=
" there will be a single patch
set that
> contains both TPM and IMA changes? Otherwise, I see it ver=
y hard to
make
> decision to apply TPM patches.
If this can be posted to the same lists, then 'yes'.
I cannot set a timeframe for this, though. Nevertheless, the vTPM driver
reviews were fruitful, I think.
The v=
TPM driver could be used standalone as well,
though it may be more useful in conjunction with the namespacing of IMA.
Stefan

> 
> /Jarkko
> 