Linux-Integrity Archive on lore.kernel.org
 help / color / Atom feed
From: Mimi Zohar <zohar@linux.ibm.com>
To: James Bottomley <James.Bottomley@HansenPartnership.com>,
	linux-integrity@vger.kernel.org
Cc: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Subject: Re: [PATCH 1/1] tpm: add sysfs exports for all banks of PCR registers
Date: Tue, 21 Jul 2020 08:30:27 -0400
Message-ID: <1595334627.5109.23.camel@linux.ibm.com> (raw)
In-Reply-To: <20200720150038.9082-2-James.Bottomley@HansenPartnership.com>

Hi James,

On Mon, 2020-07-20 at 08:00 -0700, James Bottomley wrote:
> use macro magic to create sysfs per hash groups with 24 PCR files in
> them one for each possible agile hash of the TPM.  The files are
> plugged in to a read function which is TPM version agnostic, so this
> works also for TPM 1.2 although the hash is only sha1 in that case.
> For every hash the TPM supports, a group named pcr-<hash> is created
> and each of the PCR read files placed under it.
> 
> Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>

Nice!  Being able to read the TPM 2.0 PCRs, without requiring a TSS,
will really simplify regression testing - re-calculating the IMA
"boot_aggregate" and verifying the IMA measurement list.

With the following code snippet all of the PCRs for all the exported
TPM banks are displayed, but unfortunately the digests are not ordered
or prefixed with the PCR.

banks=$(echo -n $(ls -d /sys/class/tpm/tpm0/pcr-*))

for bank in ${banks[@]}; do
        echo "$bank:"
        find "${bank}/" -type f -exec cat {} \;
        echo " "
done

Either this code snippet needs to be fixed or, perhaps, instead of
returning just the digest, the digest could be prefixed with the PCR
number (eg. PCR-00:<digest>).

FYI, with this patch on a system with TPM 1.2, IMA goes into TPM-
bypass mode.

From dmesg (with some extra debugging):
tpm_chip_register: tpm_add_legacy_sysfs failed
tpm_tis: probe of 00:05 failed with error -2

Mimi

  reply index

Thread overview: 6+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-07-20 15:00 [PATCH 0/1] add sysfs exports for TPM 2 " James Bottomley
2020-07-20 15:00 ` [PATCH 1/1] tpm: add sysfs exports for all banks of " James Bottomley
2020-07-21 12:30   ` Mimi Zohar [this message]
2020-07-21 15:06     ` James Bottomley
2020-07-21 15:47       ` Mimi Zohar
2020-07-21 15:52         ` James Bottomley

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1595334627.5109.23.camel@linux.ibm.com \
    --to=zohar@linux.ibm.com \
    --cc=James.Bottomley@HansenPartnership.com \
    --cc=jarkko.sakkinen@linux.intel.com \
    --cc=linux-integrity@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

Linux-Integrity Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/linux-integrity/0 linux-integrity/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 linux-integrity linux-integrity/ https://lore.kernel.org/linux-integrity \
		linux-integrity@vger.kernel.org
	public-inbox-index linux-integrity

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.linux-integrity


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git