linux-integrity.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Lakshmi Ramasubramanian <nramas@linux.microsoft.com>
To: Mimi Zohar <zohar@linux.ibm.com>, linux-integrity@vger.kernel.org
Subject: ima_tpm_chip is queried and saved only at IMA init, but never later
Date: Tue, 24 Sep 2019 15:31:18 -0700	[thread overview]
Message-ID: <d9c28fc6-bd5e-95ae-6386-84e87125c41d@linux.microsoft.com> (raw)

When IMA is initialized the default TPM is queried and saved.
If at this point a TPM wasn't available, but is detected and surfaced 
later by the system, IMA doesn't update the TPM information.

security/integrity/ima/ima_init.c
int __init ima_init(void)
{
	int rc;

	ima_tpm_chip = tpm_default_chip();
	if (!ima_tpm_chip)
		pr_info("No TPM chip found, activating TPM-bypass!\n");
	...
}

TPM PCR update function in IMA is essentially a NOP if TPM wasn't 
detected during IMA init.

security/integrity/ima/ima_queue.c
static int ima_pcr_extend(const u8 *hash, int pcr)
{
	int result = 0;

	if (!ima_tpm_chip)
		return result;
	...
}

In one configuration I am testing, I see the TPM appear post IMA Init. 
Likely this is rare, but I was wondering if there was a reason why TPM 
information is only queried during IMA init, but never updated at a 
later point.

Thanks,
  -lakshmi

             reply	other threads:[~2019-09-24 22:31 UTC|newest]

Thread overview: 6+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-09-24 22:31 Lakshmi Ramasubramanian [this message]
2019-09-24 22:37 ` James Bottomley
2019-10-03 15:40   ` Lakshmi Ramasubramanian
2019-10-03 15:49     ` Mimi Zohar
2019-10-04  0:39       ` Lakshmi Ramasubramanian
2019-10-03 15:58     ` James Bottomley

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=d9c28fc6-bd5e-95ae-6386-84e87125c41d@linux.microsoft.com \
    --to=nramas@linux.microsoft.com \
    --cc=linux-integrity@vger.kernel.org \
    --cc=zohar@linux.ibm.com \
    --subject='Re: ima_tpm_chip is queried and saved only at IMA init, but never later' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).