* [PATCH v2] ima-evm-utils: skip test for discrete TPM 1.2 and exec'd as normal user
@ 2020-06-24 22:38 Bruno Meneguele
2020-06-24 22:44 ` Bruno Meneguele
0 siblings, 1 reply; 2+ messages in thread
From: Bruno Meneguele @ 2020-06-24 22:38 UTC (permalink / raw)
To: linux-integrity; +Cc: zohar, Bruno Meneguele
boot_aggregate test make use of a software TPM 2.0 in case it doesn't find
any /dev/tpm0 in the system or if the test is ran as a normal user. However,
when the system has a discrete TPM 1.2 and the user runs the test with a
non-root user evmctl fails to return the software TPM 2.0 boot aggregate
value because it tries to access TPM 1.2 the sysfs PCRs file and,
consequently, the test fails. Thus TPM 2.0 log test is not supported on
systems with a discrete TPM 1.2
Signed-off-by: Bruno Meneguele <bmeneg@redhat.com>
---
tests/boot_aggregate.test | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/tests/boot_aggregate.test b/tests/boot_aggregate.test
index fe0c9aa..43de67d 100755
--- a/tests/boot_aggregate.test
+++ b/tests/boot_aggregate.test
@@ -23,6 +23,8 @@ export LD_LIBRARY_PATH=$LD_LIBRARY_PATH
. ./functions.sh
_require evmctl
TSSDIR="$(dirname -- "$(which tssstartup)")"
+PCRFILE="/sys/class/tpm/tpm0/device/pcrs"
+MISC_PCRFILE="/sys/class/misc/tpm0/device/pcrs"
if [ "$(id -u)" = 0 ] && [ -c "/dev/tpm0" ]; then
ASCII_RUNTIME_MEASUREMENTS="/sys/kernel/security/ima/ascii_runtime_measurements"
@@ -133,6 +135,11 @@ check() {
# Start and initialize a software TPM as needed
if [ "$(id -u)" != 0 ] || [ ! -c "/dev/tpm0" ]; then
+ if [ -f "$PCRFILE" ] || [ -f "$MISC_PCRFILE" ]; then
+ echo "${CYAN}SKIP: system has discrete TPM 1.2, sample TPM 2.0 event log test not supported.${NORM}"
+ exit "$SKIP"
+ fi
+
swtpm_start
error=$?
if [ $error -eq "$SKIP" ]; then
--
2.26.2
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH v2] ima-evm-utils: skip test for discrete TPM 1.2 and exec'd as normal user
2020-06-24 22:38 [PATCH v2] ima-evm-utils: skip test for discrete TPM 1.2 and exec'd as normal user Bruno Meneguele
@ 2020-06-24 22:44 ` Bruno Meneguele
0 siblings, 0 replies; 2+ messages in thread
From: Bruno Meneguele @ 2020-06-24 22:44 UTC (permalink / raw)
To: linux-integrity; +Cc: zohar
[-- Attachment #1: Type: text/plain, Size: 1932 bytes --]
On Wed, Jun 24, 2020 at 07:38:29PM -0300, Bruno Meneguele wrote:
> boot_aggregate test make use of a software TPM 2.0 in case it doesn't find
> any /dev/tpm0 in the system or if the test is ran as a normal user. However,
> when the system has a discrete TPM 1.2 and the user runs the test with a
> non-root user evmctl fails to return the software TPM 2.0 boot aggregate
> value because it tries to access TPM 1.2 the sysfs PCRs file and,
> consequently, the test fails. Thus TPM 2.0 log test is not supported on
> systems with a discrete TPM 1.2
>
> Signed-off-by: Bruno Meneguele <bmeneg@redhat.com>
> ---
Should've added the changelog note, but considering it doesn't make git
history, for those reviewing the patch:
v1->v2:
- fixed a statement in commit log only.
> tests/boot_aggregate.test | 7 +++++++
> 1 file changed, 7 insertions(+)
>
> diff --git a/tests/boot_aggregate.test b/tests/boot_aggregate.test
> index fe0c9aa..43de67d 100755
> --- a/tests/boot_aggregate.test
> +++ b/tests/boot_aggregate.test
> @@ -23,6 +23,8 @@ export LD_LIBRARY_PATH=$LD_LIBRARY_PATH
> . ./functions.sh
> _require evmctl
> TSSDIR="$(dirname -- "$(which tssstartup)")"
> +PCRFILE="/sys/class/tpm/tpm0/device/pcrs"
> +MISC_PCRFILE="/sys/class/misc/tpm0/device/pcrs"
>
> if [ "$(id -u)" = 0 ] && [ -c "/dev/tpm0" ]; then
> ASCII_RUNTIME_MEASUREMENTS="/sys/kernel/security/ima/ascii_runtime_measurements"
> @@ -133,6 +135,11 @@ check() {
>
> # Start and initialize a software TPM as needed
> if [ "$(id -u)" != 0 ] || [ ! -c "/dev/tpm0" ]; then
> + if [ -f "$PCRFILE" ] || [ -f "$MISC_PCRFILE" ]; then
> + echo "${CYAN}SKIP: system has discrete TPM 1.2, sample TPM 2.0 event log test not supported.${NORM}"
> + exit "$SKIP"
> + fi
> +
> swtpm_start
> error=$?
> if [ $error -eq "$SKIP" ]; then
> --
> 2.26.2
>
--
bmeneg
PGP Key: http://bmeneg.com/pubkey.txt
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2020-06-24 22:44 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-06-24 22:38 [PATCH v2] ima-evm-utils: skip test for discrete TPM 1.2 and exec'd as normal user Bruno Meneguele
2020-06-24 22:44 ` Bruno Meneguele
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).