From: Jarkko Sakkinen <jarkko@kernel.org>
To: Stefan Berger <stefanb@linux.vnet.ibm.com>
Cc: linux-integrity@vger.kernel.org, peterhuewe@gmx.de,
linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org,
skhan@linuxfoundation.org, Stefan Berger <stefanb@linux.ibm.com>
Subject: Re: [PATCH v4 2/2] selftests: tpm2: Reset the dictionary attack lock
Date: Tue, 30 Nov 2021 01:43:10 +0200 [thread overview]
Message-ID: <YaVljk1vLRZ/TDJ/@iki.fi> (raw)
In-Reply-To: <20211128041052.1395504-3-stefanb@linux.vnet.ibm.com>
On Sat, Nov 27, 2021 at 11:10:52PM -0500, Stefan Berger wrote:
> From: Stefan Berger <stefanb@linux.ibm.com>
>
> Reset the dictionary attack lock to avoid the following types of test
> failures after running the test 2 times:
>
> ======================================================================
> ERROR: test_unseal_with_wrong_policy (tpm2_tests.SmokeTest)
> ----------------------------------------------------------------------
> Traceback (most recent call last):
> File "/root/linux-ima-namespaces/tools/testing/selftests/tpm2/tpm2_tests.py", line 105, in test_unseal_with_wrong_policy
> blob = self.client.seal(self.root_key, data, auth, policy_dig)
> File "/root/linux-ima-namespaces/tools/testing/selftests/tpm2/tpm2.py", line 620, in seal
> rsp = self.send_cmd(cmd)
> File "/root/linux-ima-namespaces/tools/testing/selftests/tpm2/tpm2.py", line 397, in send_cmd
> raise ProtocolError(cc, rc)
> tpm2.ProtocolError: TPM_RC_LOCKOUT: cc=0x00000153, rc=0x00000921
>
> Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
> ---
> tools/testing/selftests/tpm2/tpm2_tests.py | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/tools/testing/selftests/tpm2/tpm2_tests.py b/tools/testing/selftests/tpm2/tpm2_tests.py
> index e63a37819978..ad6f54c01adf 100644
> --- a/tools/testing/selftests/tpm2/tpm2_tests.py
> +++ b/tools/testing/selftests/tpm2/tpm2_tests.py
> @@ -139,6 +139,8 @@ class SmokeTest(unittest.TestCase):
> except:
> self.client.flush_context(handle)
> raise
> + finally:
> + self.client.reset_da_lock()
>
> self.assertEqual(rc, tpm2.TPM2_RC_POLICY_FAIL)
>
> --
> 2.31.1
>
I don't agree with this as a DA lock has legit use. This would be adequate
for systems dedicated for kernel testing only.
We could make this available in the folder where TPM2 tests are:
https://git.kernel.org/pub/scm/linux/kernel/git/jarkko/tpm2-scripts.git/tree/tpm2-reset-da-lock
/Jarkko
next prev parent reply other threads:[~2021-11-29 23:43 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-11-28 4:10 [PATCH v4 0/2] selftests: tpm2: Determine available PCR bank Stefan Berger
2021-11-28 4:10 ` [PATCH v4 1/2] " Stefan Berger
2021-11-29 23:39 ` Jarkko Sakkinen
2021-12-24 1:12 ` Stefan Berger
2022-01-13 18:04 ` Stefan Berger
2022-01-15 15:53 ` Jarkko Sakkinen
2022-01-15 17:02 ` Jarkko Sakkinen
2021-11-28 4:10 ` [PATCH v4 2/2] selftests: tpm2: Reset the dictionary attack lock Stefan Berger
2021-11-29 23:43 ` Jarkko Sakkinen [this message]
2021-11-30 0:26 ` Stefan Berger
2021-12-01 10:16 ` Jarkko Sakkinen
2021-12-01 10:19 ` Jarkko Sakkinen
2021-12-01 14:52 ` Stefan Berger
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=YaVljk1vLRZ/TDJ/@iki.fi \
--to=jarkko@kernel.org \
--cc=linux-integrity@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-kselftest@vger.kernel.org \
--cc=peterhuewe@gmx.de \
--cc=skhan@linuxfoundation.org \
--cc=stefanb@linux.ibm.com \
--cc=stefanb@linux.vnet.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.