Re: [tpm2] tpm2-abrmd in a container

* Re: [tpm2] tpm2-abrmd in a container
@ 2019-02-06  7:50 Luke Hinds
  0 siblings, 0 replies; 8+ messages in thread
From: Luke Hinds @ 2019-02-06  7:50 UTC (permalink / raw)
  To: tpm2

[-- Attachment #1: Type: text/plain, Size: 6800 bytes --]

On Wed, 6 Feb 2019, 00:43 Javier Martinez Canillas <javierm(a)redhat.com
wrote:

> Hello Luke,
>
> On 2/5/19 4:40 PM, Luke Hinds wrote:
>
> [snip]
>
> > Almost have this working now or perhaps getting warmer. I am now looking
> > for some advice on what values and arguments I should be using to make
> sure
> > connectivity goes from tpm2-tools > tpm2-abrmd > tpm2 mssim
> >
> > Within my container I run:
> >
> > mkdir -p /var/run/dbus/
> > dbus-daemon --fork --system
> >
> > start the simulator:
> >
> > tpm_server &
> > [1] 24
> > [root(a)a2d41fb37bb3 src]# TPM command server listening on port 2321
> > Platform server listening on port 2322
> >
> > If I now run:
> >
> > [root(a)a2d41fb37bb3 src]# /usr/local/sbin/tpm2-abrmd --allow-root
> > --tcti=mssim &
> >
> > I can see an active bus:
> >
> > [root(a)a2d41fb37bb3 src]# dbus-send --system --dest=org.freedesktop.DBus
> > --type=method_call --print-reply /org/freedesktop/DBus
> > org.freedesktop.DBus.ListNames
> > method return time=1549380992.829764 sender=org.freedesktop.DBus ->
> > destination=:1.7 serial=3 reply_serial=2
> >    array [
> >       string "org.freedesktop.DBus"
> >       string ":1.7"
> >       string "com.intel.tss2.Tabrmd"
> >       string ":1.6"
> >    ]
> >
> >
> > [root(a)a2d41fb37bb3 src]# dbus-send --system --dest=com.intel.tss2.Tabrmd
> > --type=method_call --print-reply /com/intel/tss2/Tabrmd/Tcti
> > org.freedesktop.DBus.Introspectable.Introspect
> > method return time=1549381010.989948 sender=:1.6 -> destination=:1.8
> > serial=7 reply_serial=2
> >    string "<!DOCTYPE node PUBLIC "-//freedesktop//DTD D-BUS Object
> > Introspection 1.0//EN"
> >                       "
> > http://www.freedesktop.org/standards/dbus/1.0/introspect.dtd">
> > <!-- GDBus 2.58.3 -->
> > <node>
> >   <interface name="org.freedesktop.DBus.Properties">
> >     <method name="Get">
> >       <arg type="s" name="interface_name" direction="in"/>
> >       <arg type="s" name="property_name" direction="in"/>
> >       <arg type="v" name="value" direction="out"/>
> >     </method>
> >     <method name="GetAll">
> >       <arg type="s" name="interface_name" direction="in"/>
> >       <arg type="a{sv}" name="properties" direction="out"/>
> >     </method>
> >     <method name="Set">
> >       <arg type="s" name="interface_name" direction="in"/>
> >       <arg type="s" name="property_name" direction="in"/>
> >       <arg type="v" name="value" direction="in"/>
> >     </method>
> >     <signal name="PropertiesChanged">
> >       <arg type="s" name="interface_name"/>
> >       <arg type="a{sv}" name="changed_properties"/>
> >       <arg type="as" name="invalidated_properties"/>
> >     </signal>
> >   </interface>
> >   <interface name="org.freedesktop.DBus.Introspectable">
> >     <method name="Introspect">
> >       <arg type="s" name="xml_data" direction="out"/>
> >     </method>
> >   </interface>
> >   <interface name="org.freedesktop.DBus.Peer">
> >     <method name="Ping"/>
> >     <method name="GetMachineId">
> >       <arg type="s" name="machine_uuid" direction="out"/>
> >     </method>
> >   </interface>
> >   <interface name="com.intel.tss2.TctiTabrmd">
> >     <method name="CreateConnection">
> >       <arg type="ah" name="fds" direction="out"/>
> >       <arg type="t" name="id" direction="out"/>
> >     </method>
> >     <method name="Cancel">
> >       <arg type="t" name="id" direction="in"/>
> >       <arg type="u" name="return_code" direction="out"/>
> >     </method>
> >     <method name="SetLocality">
> >       <arg type="t" name="id" direction="in"/>
> >       <arg type="y" name="locality" direction="in"/>
> >       <arg type="u" name="return_code" direction="out"/>
> >     </method>
> >   </interface>
> > </node>
> >
>
> I believe the tpm2-abmrd + MSFT simulator part is correct.
>
> > The part I am now not sure of, is how to configure TPM2TOOLS_TCTI and
> what
> > args should be used for the RM.
> >
> > As it is, its expected with TPM2TOOLS_TCTI undeclared  :
> >
> > [root(a)a2d41fb37bb3 src]# tpm2_pcrlist
> > ERROR:tcti:src/tss2-tcti/tcti-device.c:399:Tss2_Tcti_Device_Init() Failed
> > to open device file /dev/tpm0: No such file or directory
> > ERROR: tcti init allocation routine failed for library: "device" options:
> > "(null)"
> > ERROR: Could not load tcti, got: "device"
> >
> > I have then tried different variations:
> >
> > export TPM2TOOLS_TCTI="mssim:host=localhost,port=2321"
> > export TPM2TOOLS_TCTI="mssim:port=2321"
> > export TPM2TOOLS_TCTI="mssim:tcp://127.0.0.1:2321"
> >
> > I am guessing this would be wrong though? I don't want the tools
> connecting
> > to the mssim, I want them connecting to the resource manager.
> >
>
> That's correct. You have to use the abrmd TCTI since the tools don't care
> that
> the abrmd is talking to the simulator instead of a TPM device.
>
> > I should also mention, none of the above work - running `tpm2_pcrlist`
> just
> > results in the command hanging and needing a ctrl c to break out.
> >
> > [root(a)a2d41fb37bb3 src]# export
> >
> TPM2TOOLS_TCTI="tabrmd:bus_name=com.intel.tss2.Tabrmd,tabrmd:bus_type=session"
> > [root(a)a2d41fb37bb3 src]# tpm2_pcrlist
> > ERROR: Could not dlopen library: "tabrmd"
> > ERROR: Could not load tcti, got: "tabrmd"
> >
> > So I then tried try this:
> >
> > [root(a)a2d41fb37bb3 src]# /usr/local/sbin/tpm2-abrmd --allow-root
> > --tcti=libtss2-tcti-mssim.so &
> > [root(a)a2d41fb37bb3 src]# export TPM2TOOLS_TCTI="mssim:port=2321"
> > [root(a)a2d41fb37bb3 src]# tpm2_pcrlist
> >
> > Unfortunately the command just hangs, needing a ctrl-c to break the
> session.
> >
> > I am aware I may be "making a pigs ear" of this, if so excuse my
> > green'ness.
> >
> > If anyone can point me towards what args I should be using for the
> > connectivity flow I outlined towards the start of this email, that would
> be
> > great!
> >
>
> What's your exact version of the tpm2-abrmd, tpm2-tss and tpm2-tools? Can
> you
> do "export =all+TRACE" before executing tpm2_pcrlist to see where the
> libraries are hanging?
>

I am thinking it might have something to do with dbus now. I ran a systemd
based container with the same steps / versions. pcrlist was then returned
with no issues.

I will definitely check with TSS2_LOG set though, so we know what's
happening. I can run a privileged container for my needs (CI Tests) so
there is no security concerns, but I am sure others will in the future want
to run a limited instance.

Thanks Luke!

> > Thanks,
> >
> > Luke
> >
>
> Best regards,
> --
> Javier Martinez Canillas
> Software Engineer - Desktop Hardware Enablement
> Red Hat
>

[-- Attachment #2: attachment.html --]
[-- Type: text/html, Size: 9767 bytes --]

^ permalink raw reply	[flat|nested] 8+ messages in thread