[PATCH] selftest/trustedkeys: TPM 1.2 trusted keys test

* [PATCH] selftest/trustedkeys: TPM 1.2 trusted keys test
@ 2019-09-10 23:18 Mimi Zohar
  2019-09-10 23:24 ` Mimi Zohar
                   ` (2 more replies)
  0 siblings, 3 replies; 20+ messages in thread
From: Mimi Zohar @ 2019-09-10 23:18 UTC (permalink / raw)
  To: linux-integrity; +Cc: Jarkko Sakkinen, Roberto Sassu, Mimi Zohar

Create, save and load trusted keys test

Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
---
 tools/testing/selftests/tpm2/Makefile            |  2 +-
 tools/testing/selftests/tpm2/test_trustedkeys.sh | 99 ++++++++++++++++++++++++
 2 files changed, 100 insertions(+), 1 deletion(-)
 create mode 100755 tools/testing/selftests/tpm2/test_trustedkeys.sh

diff --git a/tools/testing/selftests/tpm2/Makefile b/tools/testing/selftests/tpm2/Makefile
index 9dd848427a7b..6c76495c9a69 100644
--- a/tools/testing/selftests/tpm2/Makefile
+++ b/tools/testing/selftests/tpm2/Makefile
@@ -1,4 +1,4 @@
 # SPDX-License-Identifier: (GPL-2.0 OR BSD-3-Clause)
 include ../lib.mk
 
-TEST_PROGS := test_smoke.sh test_space.sh
+TEST_PROGS := test_smoke.sh test_space.sh test_trustedkey.sh
diff --git a/tools/testing/selftests/tpm2/test_trustedkeys.sh b/tools/testing/selftests/tpm2/test_trustedkeys.sh
new file mode 100755
index 000000000000..00b041d31646
--- /dev/null
+++ b/tools/testing/selftests/tpm2/test_trustedkeys.sh
@@ -0,0 +1,99 @@
+#!/bin/sh
+
+VERBOSE="${VERBOSE:-1}"
+TRUSTEDKEY1="$(mktemp -u XXXX).blob"
+TRUSTEDKEY2="$(mktemp -u XXXX).blob"
+trap "{ rm -f $TRUSTEDKEY1 $TRUSTEDKEY2 ; }" EXIT
+
+log_info()
+{
+        [ $VERBOSE -ne 0 ] && echo "[INFO] $1"
+}
+
+# The ksefltest framework requirement returns 0 for PASS.
+log_pass()
+{
+        [ $VERBOSE -ne 0 ] && echo "$1 [PASS]"
+        exit 0
+}
+
+# The ksefltest framework requirement returns 1 for FAIL.
+log_fail()
+{
+        [ $VERBOSE -ne 0 ] && echo "$1 [FAIL]"
+        exit 1
+}
+
+# The ksefltest framework requirement returns 4 for SKIP.
+log_skip()
+{
+        [ $VERBOSE -ne 0 ] && echo "$1"
+        exit 4
+}
+
+is_tpm1()
+{
+	local pcrs_path="/sys/class/tpm/tpm0/device/pcrs"
+	if [ ! -f "$pcrs_path" ]; then
+		pcrs_path="/sys/class/misc/tpm0/device/pcrs"
+	fi
+
+	if [ ! -f "$pcrs_path" ]; then
+		log_skip "TPM 1.2 chip not found"
+	fi
+}
+
+takeownership_info()
+{
+	which tcsd > /dev/null 2>&1 || \
+		log_skip "tcsd not found, install trousers"
+
+	which tpm_takeownership > /dev/null 2>&1 || \
+		log_skip "tpm_takeownerhip not found, install tpm-tools"
+
+	log_info "creating trusted key failed, probably requires taking TPM ownership:"
+	log_info "	systemctl start tcsd"
+	log_info "	tpm_takeownership -u -z"
+	log_fail "creating trusted key"
+}
+
+test_trustedkey()
+{
+	local keyid="$(keyctl add trusted kmk-test "new 64" @u)" &> /dev/null
+	if [ -z "$keyid" ]; then
+		takeownership_info
+	fi
+
+	if [ $? -eq 0 ]; then
+		log_info "creating trusted key succeeded"
+	else
+		log_fail "creating trusted key failed"
+	fi
+
+	# save newly created trusted key and remove from keyring
+	keyctl pipe "$keyid" > "$TRUSTEDKEY1"
+	keyctl unlink "$keyid" &> /dev/null
+
+	keyid=$(keyctl add trusted kmk-test "load `cat $TRUSTEDKEY1`" @u)
+	if [ $? -eq 0 ]; then
+		log_info "loading trusted key succeeded"
+	else
+		log_fail "loading trusted key failed"
+	fi
+
+	# save loaded trusted key and remove from keyring again
+	keyctl pipe "$keyid" > "$TRUSTEDKEY2"
+	keyctl unlink "$keyid" &> /dev/null
+
+	# compare trusted keys
+	diff "$TRUSTEDKEY1" "$TRUSTEDKEY2" &> /dev/null
+	ret=$?
+	if [ $ret -eq 0 ]; then
+		log_pass "trusted key test succeeded"
+	else
+		log_fail "trusted key test failed"
+	fi
+}
+
+is_tpm1
+test_trustedkey
-- 
2.7.5


^ permalink raw reply related	[flat|nested] 20+ messages in thread