From: Tyler Hicks <tyhicks@canonical.com> To: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> Cc: Roberto Sassu <roberto.sassu@huawei.com>, jejb@linux.ibm.com, zohar@linux.ibm.com, jgg@ziepe.ca, linux-integrity@vger.kernel.org, linux-security-module@vger.kernel.org, keyrings@vger.kernel.org, linux-kernel@vger.kernel.org, crazyt2019+lml@gmail.com, nayna@linux.vnet.ibm.com, silviu.vlasceanu@huawei.com Subject: Re: [PATCH] KEYS: trusted: allow module init if TPM is inactive or deactivated Date: Fri, 02 Aug 2019 20:35:33 +0000 [thread overview] Message-ID: <20190802203532.GF26616@elm> (raw) In-Reply-To: <20190802202343.GE26616@elm> On 2019-08-02 15:23:43, Tyler Hicks wrote: > On 2019-08-02 22:42:26, Jarkko Sakkinen wrote: > > On Fri, Aug 02, 2019 at 09:27:22AM -0500, Tyler Hicks wrote: > > > On 2019-08-02 10:21:16, Roberto Sassu wrote: > > > > On 8/1/2019 6:32 PM, Jarkko Sakkinen wrote: > > > > > On Mon, Jul 15, 2019 at 06:44:28PM +0200, Roberto Sassu wrote: > > > > > > According to the bug report at https://bugs.archlinux.org/task/62678, > > > > > > the trusted module is a dependency of the ecryptfs module. We should > > > > > > load the trusted module even if the TPM is inactive or deactivated. > > > > > > > > > > > > Given that commit 782779b60faa ("tpm: Actually fail on TPM errors during > > > > > > "get random"") changes the return code of tpm_get_random(), the patch > > > > > > should be modified to ignore the -EIO error. I will send a new version. > > > > > > > > > > Do you have information where this dependency comes from? > > > > > > > > ecryptfs retrieves the encryption key from encrypted keys (see > > > > ecryptfs_get_encrypted_key()). > > > > > > That has been there for many years with any problems. It was added > > > in 2011: > > > > > > commit 1252cc3b232e582e887623dc5f70979418caaaa2 > > > Author: Roberto Sassu <roberto.sassu@polito.it> > > > Date: Mon Jun 27 13:45:45 2011 +0200 > > > > > > eCryptfs: added support for the encrypted key type > > > > > > What's recently changed the situation is this patch: > > > > > > commit 240730437deb213a58915830884e1a99045624dc > > > Author: Roberto Sassu <roberto.sassu@huawei.com> > > > Date: Wed Feb 6 17:24:51 2019 +0100 > > > > > > KEYS: trusted: explicitly use tpm_chip structure from tpm_default_chip() > > > > > > Now eCryptfs has a hard dependency on a TPM chip that's working > > > as expected even if eCryptfs (or the rest of the system) isn't utilizing > > > the TPM. If the TPM behaves unexpectedly, you can't access your files. > > > We need to get this straightened out soon. > > > > I agree with this conclusion that eCryptfs needs to be fixed, not > > another workaround to trusted.ko. > > That wasn't the conclusion that I came to. I prefer Robert's proposed > change to trusted.ko. > > How do you propose that this be fixed in eCryptfs? > > Removing encrypted_key support from eCryptfs is the only way that I can > see to fix the bug in eCryptfs. That support has been there since 2011. > I'm not sure of the number of users that would be broken by removing > encrypted_key support. I don't think the number is high but I can't say > that confidently. AFAICT, this bug doesn't only affect eCryptfs. It also affects Intel nvdimm support starting with: commit 4c6926a23b76ea23403976290cd45a7a143f6500 Author: Dave Jiang <dave.jiang@intel.com> Date: Thu Dec 6 12:40:01 2018 -0800 acpi/nfit, libnvdimm: Add unlock of nvdimm support for Intel DIMMs So without a workaround in trusted.ko, encrypted_key support will need to be removed from eCryptfs and nvdimm to address this issue. Tyler > > Roberto, what was your use case when you added encrypted_key support to > eCryptfs back then? Are you aware of any users of eCryptfs + > encrypted_keys? > > Jarkko, removing a long-standing feature is potentially more disruptive > to users than adding a workaround to trusted.ko which already requires a > similar workaround. I don't think that I agree with you on the proper > fix here. > > Tyler > > > > > /Jarkko
WARNING: multiple messages have this Message-ID (diff)
From: Tyler Hicks <tyhicks@canonical.com> To: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> Cc: Roberto Sassu <roberto.sassu@huawei.com>, jejb@linux.ibm.com, zohar@linux.ibm.com, jgg@ziepe.ca, linux-integrity@vger.kernel.org, linux-security-module@vger.kernel.org, keyrings@vger.kernel.org, linux-kernel@vger.kernel.org, crazyt2019+lml@gmail.com, nayna@linux.vnet.ibm.com, silviu.vlasceanu@huawei.com Subject: Re: [PATCH] KEYS: trusted: allow module init if TPM is inactive or deactivated Date: Fri, 2 Aug 2019 15:35:33 -0500 [thread overview] Message-ID: <20190802203532.GF26616@elm> (raw) In-Reply-To: <20190802202343.GE26616@elm> On 2019-08-02 15:23:43, Tyler Hicks wrote: > On 2019-08-02 22:42:26, Jarkko Sakkinen wrote: > > On Fri, Aug 02, 2019 at 09:27:22AM -0500, Tyler Hicks wrote: > > > On 2019-08-02 10:21:16, Roberto Sassu wrote: > > > > On 8/1/2019 6:32 PM, Jarkko Sakkinen wrote: > > > > > On Mon, Jul 15, 2019 at 06:44:28PM +0200, Roberto Sassu wrote: > > > > > > According to the bug report at https://bugs.archlinux.org/task/62678, > > > > > > the trusted module is a dependency of the ecryptfs module. We should > > > > > > load the trusted module even if the TPM is inactive or deactivated. > > > > > > > > > > > > Given that commit 782779b60faa ("tpm: Actually fail on TPM errors during > > > > > > "get random"") changes the return code of tpm_get_random(), the patch > > > > > > should be modified to ignore the -EIO error. I will send a new version. > > > > > > > > > > Do you have information where this dependency comes from? > > > > > > > > ecryptfs retrieves the encryption key from encrypted keys (see > > > > ecryptfs_get_encrypted_key()). > > > > > > That has been there for many years with any problems. It was added > > > in 2011: > > > > > > commit 1252cc3b232e582e887623dc5f70979418caaaa2 > > > Author: Roberto Sassu <roberto.sassu@polito.it> > > > Date: Mon Jun 27 13:45:45 2011 +0200 > > > > > > eCryptfs: added support for the encrypted key type > > > > > > What's recently changed the situation is this patch: > > > > > > commit 240730437deb213a58915830884e1a99045624dc > > > Author: Roberto Sassu <roberto.sassu@huawei.com> > > > Date: Wed Feb 6 17:24:51 2019 +0100 > > > > > > KEYS: trusted: explicitly use tpm_chip structure from tpm_default_chip() > > > > > > Now eCryptfs has a hard dependency on a TPM chip that's working > > > as expected even if eCryptfs (or the rest of the system) isn't utilizing > > > the TPM. If the TPM behaves unexpectedly, you can't access your files. > > > We need to get this straightened out soon. > > > > I agree with this conclusion that eCryptfs needs to be fixed, not > > another workaround to trusted.ko. > > That wasn't the conclusion that I came to. I prefer Robert's proposed > change to trusted.ko. > > How do you propose that this be fixed in eCryptfs? > > Removing encrypted_key support from eCryptfs is the only way that I can > see to fix the bug in eCryptfs. That support has been there since 2011. > I'm not sure of the number of users that would be broken by removing > encrypted_key support. I don't think the number is high but I can't say > that confidently. AFAICT, this bug doesn't only affect eCryptfs. It also affects Intel nvdimm support starting with: commit 4c6926a23b76ea23403976290cd45a7a143f6500 Author: Dave Jiang <dave.jiang@intel.com> Date: Thu Dec 6 12:40:01 2018 -0800 acpi/nfit, libnvdimm: Add unlock of nvdimm support for Intel DIMMs So without a workaround in trusted.ko, encrypted_key support will need to be removed from eCryptfs and nvdimm to address this issue. Tyler > > Roberto, what was your use case when you added encrypted_key support to > eCryptfs back then? Are you aware of any users of eCryptfs + > encrypted_keys? > > Jarkko, removing a long-standing feature is potentially more disruptive > to users than adding a workaround to trusted.ko which already requires a > similar workaround. I don't think that I agree with you on the proper > fix here. > > Tyler > > > > > /Jarkko
next prev parent reply other threads:[~2019-08-02 20:35 UTC|newest] Thread overview: 48+ messages / expand[flat|nested] mbox.gz Atom feed top 2019-07-05 16:37 [PATCH] KEYS: trusted: allow module init if TPM is inactive or deactivated Roberto Sassu 2019-07-05 16:37 ` Roberto Sassu 2019-07-08 19:55 ` Tyler Hicks 2019-07-08 19:55 ` Tyler Hicks 2019-07-08 20:34 ` James Bottomley 2019-07-08 20:34 ` James Bottomley 2019-07-09 16:24 ` Jarkko Sakkinen 2019-07-09 16:24 ` Jarkko Sakkinen 2019-07-09 16:31 ` Mimi Zohar 2019-07-09 16:31 ` Mimi Zohar 2019-08-02 21:18 ` Tyler Hicks 2019-08-02 21:18 ` Tyler Hicks 2019-07-11 19:48 ` Jarkko Sakkinen 2019-07-11 19:48 ` Jarkko Sakkinen 2019-07-15 16:44 ` Roberto Sassu 2019-07-15 16:44 ` Roberto Sassu 2019-08-01 16:32 ` Jarkko Sakkinen 2019-08-01 16:32 ` Jarkko Sakkinen 2019-08-02 8:21 ` Roberto Sassu 2019-08-02 8:21 ` Roberto Sassu 2019-08-02 14:27 ` Tyler Hicks 2019-08-02 14:27 ` Tyler Hicks 2019-08-02 19:42 ` Jarkko Sakkinen 2019-08-02 19:42 ` Jarkko Sakkinen 2019-08-02 20:23 ` Tyler Hicks 2019-08-02 20:23 ` Tyler Hicks 2019-08-02 20:35 ` Tyler Hicks [this message] 2019-08-02 20:35 ` Tyler Hicks 2019-08-03 14:44 ` Jarkko Sakkinen 2019-08-03 14:44 ` Jarkko Sakkinen 2019-08-04 1:46 ` Mimi Zohar 2019-08-04 1:46 ` Mimi Zohar 2019-08-05 14:50 ` Roberto Sassu 2019-08-05 14:50 ` Roberto Sassu 2019-08-05 15:54 ` Mimi Zohar 2019-08-05 15:54 ` Mimi Zohar 2019-08-05 16:04 ` Roberto Sassu 2019-08-05 16:04 ` Roberto Sassu 2019-08-05 16:04 ` Tyler Hicks 2019-08-05 16:04 ` Tyler Hicks 2019-08-05 16:51 ` Roberto Sassu 2019-08-05 16:51 ` Roberto Sassu 2019-08-05 16:53 ` Tyler Hicks 2019-08-05 16:53 ` Tyler Hicks 2019-08-05 22:11 ` Jarkko Sakkinen 2019-08-05 22:11 ` Jarkko Sakkinen 2019-08-02 19:40 ` Jarkko Sakkinen 2019-08-02 19:40 ` Jarkko Sakkinen
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20190802203532.GF26616@elm \ --to=tyhicks@canonical.com \ --cc=crazyt2019+lml@gmail.com \ --cc=jarkko.sakkinen@linux.intel.com \ --cc=jejb@linux.ibm.com \ --cc=jgg@ziepe.ca \ --cc=keyrings@vger.kernel.org \ --cc=linux-integrity@vger.kernel.org \ --cc=linux-kernel@vger.kernel.org \ --cc=linux-security-module@vger.kernel.org \ --cc=nayna@linux.vnet.ibm.com \ --cc=roberto.sassu@huawei.com \ --cc=silviu.vlasceanu@huawei.com \ --cc=zohar@linux.ibm.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.