Re: [PATCH v5 03/11] tpm: Allow PCR 23 to be restricted to kernel-only use

From: William Roberts <bill.c.roberts@gmail.com>
To: Matthew Garrett <mgarrett@aurora.tech>
Cc: jejb@linux.ibm.com, Evan Green <evgreen@chromium.org>,
	linux-kernel@vger.kernel.org, corbet@lwn.net,
	linux-integrity@vger.kernel.org,
	Eric Biggers <ebiggers@kernel.org>,
	gwendal@chromium.org, dianders@chromium.org,
	apronin@chromium.org, Pavel Machek <pavel@ucw.cz>,
	Ben Boeckel <me@benboeckel.net>,
	rjw@rjwysocki.net, Kees Cook <keescook@chromium.org>,
	dlunev@google.com, zohar@linux.ibm.com, jarkko@kernel.org,
	linux-pm@vger.kernel.org, Matthew Garrett <mjg59@google.com>,
	Jason Gunthorpe <jgg@ziepe.ca>, Peter Huewe <peterhuewe@gmx.de>
Subject: Re: [PATCH v5 03/11] tpm: Allow PCR 23 to be restricted to kernel-only use
Date: Tue, 10 Jan 2023 10:07:06 -0600	[thread overview]
Message-ID: <CAFftDdp5vqnzJEqAYOStvn2UqDE_VUOrO-_tnsUCmd7ML8X_uA@mail.gmail.com> (raw)
In-Reply-To: <CAHSSk06sH6Ck11R7k8Pk_30KbzLzZVdBdj5MpsNfY-R_1kt_dA@mail.gmail.com>

On Tue, Jan 3, 2023 at 2:43 PM Matthew Garrett <mgarrett@aurora.tech> wrote:
>
> On Mon, Nov 14, 2022 at 9:11 AM James Bottomley <jejb@linux.ibm.com> wrote:
> >
> > On Fri, 2022-11-11 at 15:16 -0800, Evan Green wrote:
> > > Introduce a new Kconfig, TCG_TPM_RESTRICT_PCR, which if enabled
> > > restricts usermode's ability to extend or reset PCR 23.
> >
> > Could I re ask the question here that I asked of Matthew's patch set:
> >
> > https://lore.kernel.org/all/b0c4980c8fad14115daa3040979c52f07f7fbe2c.camel@linux.ibm.com/
> >
> > Which was could we use an NVRAM index in the TPM instead of a PCR?  The
> > reason for asking was that PCRs are rather precious and might get more
> > so now that Lennart has some grand scheme for using more of them in his
> > unified boot project.  Matthew promised to play with the idea but never
> > got back to the patch set to say whether he investigated this or not.
>
> Is there any way to get key creation data to include NV indexes? If
> not, no, we can't use NVRAM.

No theirs not, but there's room for qualifyingData. So some background
on this is they use the PCR value to verify it's the right key.
Since it's added by the TPM within the trust boundary its an
unforgeable value, unlike the qdata.

I think there are better ways to verify it's the right key, i.e. the
ability to wield the key, or if you have some ability to remember
state, you
could verify the name which is cryptgraphically bound to the private
key and thus TPM2_Load will fail. From what I understand they
have no ability to remember state as their verifying and executing a
resume kernel, but I am not well versed in that area of the kernel.
It makes me think that they are checking against a hardcoded known
PCR23 state and rolling it to prevent other keys from being
generated. I would consider policy locality for controlling who can
use the key and couple with policynv if revoking long lasting keys
is a need. If they are ephemeral, theirs the NULL hierarchy.

A lot of this is conjecture, as Matthew just stopped responding.
Perhaps they are away or busy, but I just wanted to weigh in on this.