Linux-Integrity Archive on lore.kernel.org
 help / color / Atom feed
* [PATCH] ima-evm-utils: skip test for discrete TPM 1.2 and exec'd as normal user
@ 2020-06-24 21:24 Bruno Meneguele
  2020-06-24 22:14 ` Mimi Zohar
  0 siblings, 1 reply; 3+ messages in thread
From: Bruno Meneguele @ 2020-06-24 21:24 UTC (permalink / raw)
  To: linux-integrity; +Cc: zohar, Bruno Meneguele

boot_aggregate test make use of a software TPM 2.0 in case it doesn't find
any /dev/tpm0 in the system or if the test is ran as a normal user. However,
when the system has a discrete TPM 1.2 and the user runs the test with a
non-root user evmctl fails to return the software TPM 2.0 boot aggregate
value because it tries to access the sysfs PCRs file and, consequently, the
test fails.

Supporting a software TPM 1.2 involved some more work and new dependency in
other programs to extend the PCRs accordingly. Because of that, just drop
support for this scenario for now.

Signed-off-by: Bruno Meneguele <bmeneg@redhat.com>
---
 tests/boot_aggregate.test | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/tests/boot_aggregate.test b/tests/boot_aggregate.test
index fe0c9aa..43de67d 100755
--- a/tests/boot_aggregate.test
+++ b/tests/boot_aggregate.test
@@ -23,6 +23,8 @@ export LD_LIBRARY_PATH=$LD_LIBRARY_PATH
 . ./functions.sh
 _require evmctl
 TSSDIR="$(dirname -- "$(which tssstartup)")"
+PCRFILE="/sys/class/tpm/tpm0/device/pcrs"
+MISC_PCRFILE="/sys/class/misc/tpm0/device/pcrs"
 
 if [ "$(id -u)" = 0 ] && [ -c "/dev/tpm0" ]; then
 	ASCII_RUNTIME_MEASUREMENTS="/sys/kernel/security/ima/ascii_runtime_measurements"
@@ -133,6 +135,11 @@ check() {
 
 # Start and initialize a software TPM as needed
 if [ "$(id -u)" != 0 ] || [ ! -c "/dev/tpm0" ]; then
+	if [ -f "$PCRFILE" ] || [ -f "$MISC_PCRFILE" ]; then
+		echo "${CYAN}SKIP: system has discrete TPM 1.2, sample TPM 2.0 event log test not supported.${NORM}"
+		exit "$SKIP"
+	fi
+
 	swtpm_start
 	error=$?
 	if [ $error -eq "$SKIP" ]; then
-- 
2.26.2


^ permalink raw reply	[flat|nested] 3+ messages in thread

* Re: [PATCH] ima-evm-utils: skip test for discrete TPM 1.2 and exec'd as normal user
  2020-06-24 21:24 [PATCH] ima-evm-utils: skip test for discrete TPM 1.2 and exec'd as normal user Bruno Meneguele
@ 2020-06-24 22:14 ` Mimi Zohar
  2020-06-24 22:36   ` Bruno Meneguele
  0 siblings, 1 reply; 3+ messages in thread
From: Mimi Zohar @ 2020-06-24 22:14 UTC (permalink / raw)
  To: Bruno Meneguele, linux-integrity

Hi Bruno,

On Wed, 2020-06-24 at 18:24 -0300, Bruno Meneguele wrote:
> boot_aggregate test make use of a software TPM 2.0 in case it doesn't find
> any /dev/tpm0 in the system or if the test is ran as a normal user. However,
> when the system has a discrete TPM 1.2 and the user runs the test with a
> non-root user evmctl fails to return the software TPM 2.0 boot aggregate
> value because it tries to access the sysfs PCRs file and, consequently, the
> test fails.
> 
> Supporting a software TPM 1.2 involved some more work and new dependency in
> other programs to extend the PCRs accordingly. Because of that, just drop
> support for this scenario for now.

The problem is that the TPM 1.2 PCRs are visible to userspace.
 Insteaad of reading the software TPM PCRs, it's reading the discrete
TPM 1.2 PCRs.  I would drop this paragraph and simply say the sample
TPM 2.0 log test is not supported on systems with a discrete TPM 1.2.

The patch itself is fine.

thanks,

Mimi

^ permalink raw reply	[flat|nested] 3+ messages in thread

* Re: [PATCH] ima-evm-utils: skip test for discrete TPM 1.2 and exec'd as normal user
  2020-06-24 22:14 ` Mimi Zohar
@ 2020-06-24 22:36   ` Bruno Meneguele
  0 siblings, 0 replies; 3+ messages in thread
From: Bruno Meneguele @ 2020-06-24 22:36 UTC (permalink / raw)
  To: Mimi Zohar; +Cc: linux-integrity


[-- Attachment #1: Type: text/plain, Size: 1206 bytes --]

On Wed, Jun 24, 2020 at 06:14:08PM -0400, Mimi Zohar wrote:
> Hi Bruno,
> 
> On Wed, 2020-06-24 at 18:24 -0300, Bruno Meneguele wrote:
> > boot_aggregate test make use of a software TPM 2.0 in case it doesn't find
> > any /dev/tpm0 in the system or if the test is ran as a normal user. However,
> > when the system has a discrete TPM 1.2 and the user runs the test with a
> > non-root user evmctl fails to return the software TPM 2.0 boot aggregate
> > value because it tries to access the sysfs PCRs file and, consequently, the
> > test fails.
> > 
> > Supporting a software TPM 1.2 involved some more work and new dependency in
> > other programs to extend the PCRs accordingly. Because of that, just drop
> > support for this scenario for now.
> 
> The problem is that the TPM 1.2 PCRs are visible to userspace.
>  Insteaad of reading the software TPM PCRs, it's reading the discrete
> TPM 1.2 PCRs.  I would drop this paragraph and simply say the sample
> TPM 2.0 log test is not supported on systems with a discrete TPM 1.2.
> 

Ack. Will send a v2 dropping it.

> The patch itself is fine.
> 
> thanks,
> 
> Mimi
> 

-- 
bmeneg 
PGP Key: http://bmeneg.com/pubkey.txt

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

^ permalink raw reply	[flat|nested] 3+ messages in thread

end of thread, back to index

Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-06-24 21:24 [PATCH] ima-evm-utils: skip test for discrete TPM 1.2 and exec'd as normal user Bruno Meneguele
2020-06-24 22:14 ` Mimi Zohar
2020-06-24 22:36   ` Bruno Meneguele

Linux-Integrity Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/linux-integrity/0 linux-integrity/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 linux-integrity linux-integrity/ https://lore.kernel.org/linux-integrity \
		linux-integrity@vger.kernel.org
	public-inbox-index linux-integrity

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.linux-integrity


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git