linux-integrity.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Mimi Zohar <zohar@linux.ibm.com>
To: Bruno Meneguele <bmeneg@redhat.com>, linux-integrity@vger.kernel.org
Subject: Re: [PATCH] ima-evm-utils: skip test for discrete TPM 1.2 and exec'd as normal user
Date: Wed, 24 Jun 2020 18:14:08 -0400	[thread overview]
Message-ID: <1593036848.27152.211.camel@linux.ibm.com> (raw)
In-Reply-To: <20200624212420.3300-1-bmeneg@redhat.com>

Hi Bruno,

On Wed, 2020-06-24 at 18:24 -0300, Bruno Meneguele wrote:
> boot_aggregate test make use of a software TPM 2.0 in case it doesn't find
> any /dev/tpm0 in the system or if the test is ran as a normal user. However,
> when the system has a discrete TPM 1.2 and the user runs the test with a
> non-root user evmctl fails to return the software TPM 2.0 boot aggregate
> value because it tries to access the sysfs PCRs file and, consequently, the
> test fails.
> 
> Supporting a software TPM 1.2 involved some more work and new dependency in
> other programs to extend the PCRs accordingly. Because of that, just drop
> support for this scenario for now.

The problem is that the TPM 1.2 PCRs are visible to userspace.
 Insteaad of reading the software TPM PCRs, it's reading the discrete
TPM 1.2 PCRs.  I would drop this paragraph and simply say the sample
TPM 2.0 log test is not supported on systems with a discrete TPM 1.2.

The patch itself is fine.

thanks,

Mimi

  reply	other threads:[~2020-06-24 22:14 UTC|newest]

Thread overview: 3+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-06-24 21:24 [PATCH] ima-evm-utils: skip test for discrete TPM 1.2 and exec'd as normal user Bruno Meneguele
2020-06-24 22:14 ` Mimi Zohar [this message]
2020-06-24 22:36   ` Bruno Meneguele

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1593036848.27152.211.camel@linux.ibm.com \
    --to=zohar@linux.ibm.com \
    --cc=bmeneg@redhat.com \
    --cc=linux-integrity@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).