From: Mimi Zohar <zohar@linux.ibm.com>
To: linux-integrity@vger.kernel.org
Cc: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>,
Roberto Sassu <roberto.sassu@huawei.com>,
Mimi Zohar <zohar@linux.ibm.com>
Subject: [PATCH] selftest/trustedkeys: TPM 1.2 trusted keys test
Date: Tue, 10 Sep 2019 19:18:31 -0400 [thread overview]
Message-ID: <1568157511-5464-1-git-send-email-zohar@linux.ibm.com> (raw)
Create, save and load trusted keys test
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
---
tools/testing/selftests/tpm2/Makefile | 2 +-
tools/testing/selftests/tpm2/test_trustedkeys.sh | 99 ++++++++++++++++++++++++
2 files changed, 100 insertions(+), 1 deletion(-)
create mode 100755 tools/testing/selftests/tpm2/test_trustedkeys.sh
diff --git a/tools/testing/selftests/tpm2/Makefile b/tools/testing/selftests/tpm2/Makefile
index 9dd848427a7b..6c76495c9a69 100644
--- a/tools/testing/selftests/tpm2/Makefile
+++ b/tools/testing/selftests/tpm2/Makefile
@@ -1,4 +1,4 @@
# SPDX-License-Identifier: (GPL-2.0 OR BSD-3-Clause)
include ../lib.mk
-TEST_PROGS := test_smoke.sh test_space.sh
+TEST_PROGS := test_smoke.sh test_space.sh test_trustedkey.sh
diff --git a/tools/testing/selftests/tpm2/test_trustedkeys.sh b/tools/testing/selftests/tpm2/test_trustedkeys.sh
new file mode 100755
index 000000000000..00b041d31646
--- /dev/null
+++ b/tools/testing/selftests/tpm2/test_trustedkeys.sh
@@ -0,0 +1,99 @@
+#!/bin/sh
+
+VERBOSE="${VERBOSE:-1}"
+TRUSTEDKEY1="$(mktemp -u XXXX).blob"
+TRUSTEDKEY2="$(mktemp -u XXXX).blob"
+trap "{ rm -f $TRUSTEDKEY1 $TRUSTEDKEY2 ; }" EXIT
+
+log_info()
+{
+ [ $VERBOSE -ne 0 ] && echo "[INFO] $1"
+}
+
+# The ksefltest framework requirement returns 0 for PASS.
+log_pass()
+{
+ [ $VERBOSE -ne 0 ] && echo "$1 [PASS]"
+ exit 0
+}
+
+# The ksefltest framework requirement returns 1 for FAIL.
+log_fail()
+{
+ [ $VERBOSE -ne 0 ] && echo "$1 [FAIL]"
+ exit 1
+}
+
+# The ksefltest framework requirement returns 4 for SKIP.
+log_skip()
+{
+ [ $VERBOSE -ne 0 ] && echo "$1"
+ exit 4
+}
+
+is_tpm1()
+{
+ local pcrs_path="/sys/class/tpm/tpm0/device/pcrs"
+ if [ ! -f "$pcrs_path" ]; then
+ pcrs_path="/sys/class/misc/tpm0/device/pcrs"
+ fi
+
+ if [ ! -f "$pcrs_path" ]; then
+ log_skip "TPM 1.2 chip not found"
+ fi
+}
+
+takeownership_info()
+{
+ which tcsd > /dev/null 2>&1 || \
+ log_skip "tcsd not found, install trousers"
+
+ which tpm_takeownership > /dev/null 2>&1 || \
+ log_skip "tpm_takeownerhip not found, install tpm-tools"
+
+ log_info "creating trusted key failed, probably requires taking TPM ownership:"
+ log_info " systemctl start tcsd"
+ log_info " tpm_takeownership -u -z"
+ log_fail "creating trusted key"
+}
+
+test_trustedkey()
+{
+ local keyid="$(keyctl add trusted kmk-test "new 64" @u)" &> /dev/null
+ if [ -z "$keyid" ]; then
+ takeownership_info
+ fi
+
+ if [ $? -eq 0 ]; then
+ log_info "creating trusted key succeeded"
+ else
+ log_fail "creating trusted key failed"
+ fi
+
+ # save newly created trusted key and remove from keyring
+ keyctl pipe "$keyid" > "$TRUSTEDKEY1"
+ keyctl unlink "$keyid" &> /dev/null
+
+ keyid=$(keyctl add trusted kmk-test "load `cat $TRUSTEDKEY1`" @u)
+ if [ $? -eq 0 ]; then
+ log_info "loading trusted key succeeded"
+ else
+ log_fail "loading trusted key failed"
+ fi
+
+ # save loaded trusted key and remove from keyring again
+ keyctl pipe "$keyid" > "$TRUSTEDKEY2"
+ keyctl unlink "$keyid" &> /dev/null
+
+ # compare trusted keys
+ diff "$TRUSTEDKEY1" "$TRUSTEDKEY2" &> /dev/null
+ ret=$?
+ if [ $ret -eq 0 ]; then
+ log_pass "trusted key test succeeded"
+ else
+ log_fail "trusted key test failed"
+ fi
+}
+
+is_tpm1
+test_trustedkey
--
2.7.5
next reply other threads:[~2019-09-10 23:18 UTC|newest]
Thread overview: 20+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-09-10 23:18 Mimi Zohar [this message]
2019-09-10 23:24 ` [PATCH] selftest/trustedkeys: TPM 1.2 trusted keys test Mimi Zohar
2019-09-11 12:00 ` Mimi Zohar
2019-09-13 14:08 ` Jarkko Sakkinen
2019-09-15 20:52 ` Mimi Zohar
2019-09-16 3:27 ` Mimi Zohar
2019-09-16 7:35 ` Jarkko Sakkinen
2019-09-16 7:48 ` Jarkko Sakkinen
2019-09-16 11:36 ` Mimi Zohar
2019-09-16 7:42 ` Jerry Snitselaar
2019-09-16 10:44 ` Sumit Garg
2019-09-16 14:00 ` Jerry Snitselaar
2019-09-16 11:52 ` Mimi Zohar
2019-09-16 14:28 ` Jerry Snitselaar
2019-09-16 7:15 ` Jarkko Sakkinen
2019-10-11 12:34 ` Jarkko Sakkinen
2019-10-11 13:01 ` Jarkko Sakkinen
2019-10-11 13:21 ` Mimi Zohar
2019-10-14 19:57 ` Jarkko Sakkinen
2019-10-22 14:43 ` Jarkko Sakkinen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1568157511-5464-1-git-send-email-zohar@linux.ibm.com \
--to=zohar@linux.ibm.com \
--cc=jarkko.sakkinen@linux.intel.com \
--cc=linux-integrity@vger.kernel.org \
--cc=roberto.sassu@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).