From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752514AbdAFBhj (ORCPT ); Thu, 5 Jan 2017 20:37:39 -0500 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]:36241 "EHLO mx0a-001b2d01.pphosted.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1752331AbdAFBha (ORCPT ); Thu, 5 Jan 2017 20:37:30 -0500 Subject: Re: [tpmdd-devel] [PATCH RFC 0/4] RFC: in-kernel resource manager From: James Bottomley To: Jason Gunthorpe Cc: "tpmdd-devel@lists.sourceforge.net" , "linux-security-module@vger.kernel.org" , open list Date: Thu, 05 Jan 2017 14:58:46 -0800 In-Reply-To: <20170105222118.GC31047@obsidianresearch.com> References: <20170102132213.22880-1-jarkko.sakkinen@linux.intel.com> <9F48E1A823B03B4790B7E6E69430724DC7C149F6@exch2010c.sit.fraunhofer.de> <20170105172726.GA11680@obsidianresearch.com> <1483641223.2515.62.camel@linux.vnet.ibm.com> <20170105192025.GB12587@obsidianresearch.com> <1483646149.2515.83.camel@linux.vnet.ibm.com> <20170105222118.GC31047@obsidianresearch.com> Content-Type: text/plain; charset="UTF-8" X-Mailer: Evolution 3.16.5 Mime-Version: 1.0 Content-Transfer-Encoding: 7bit X-TM-AS-GCONF: 00 X-Content-Scanned: Fidelis XPS MAILER x-cbid: 17010522-0040-0000-0000-00000249BECE X-IBM-SpamModules-Scores: X-IBM-SpamModules-Versions: BY=3.00006380; HX=3.00000240; KW=3.00000007; PH=3.00000004; SC=3.00000199; SDB=6.00804078; UDB=6.00391248; IPR=6.00581926; BA=6.00005031; NDR=6.00000001; ZLA=6.00000005; ZF=6.00000009; ZB=6.00000000; ZP=6.00000000; ZH=6.00000000; ZU=6.00000002; MB=3.00013836; XFM=3.00000011; UTC=2017-01-05 22:58:50 X-IBM-AV-DETECTION: SAVI=unused REMOTE=unused XFE=unused x-cbparentid: 17010522-0041-0000-0000-0000063CC373 Message-Id: <1483657126.2515.107.camel@linux.vnet.ibm.com> X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:,, definitions=2017-01-05_17:,, signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=0 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1612050000 definitions=main-1701050331 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Thu, 2017-01-05 at 15:21 -0700, Jason Gunthorpe wrote: > On Thu, Jan 05, 2017 at 11:55:49AM -0800, James Bottomley wrote: > > > We don't really have that choice: Keys require authorization, so > > you have to have an auth session. > > I know, this is why I suggested a combo op (kernel level atomicity > is clearly DOS safe).. Transactions are a hard thing to guarantee to be DoS safe and the more complex they get, the more difficult they are to police within the kernel. Plus we have to keep the R/W interface for backwards compatibility now that we have it and I just don't see how we could layer transactions into it without having some sort of in-kernel emulator. > > If you want things like PCR sealed or time limited keys, you don't > > really have a choice on policy sessions either. > > .. and advanced stuff like is what I was talking about giving up for > unpriv if it can't be allowed safely ... > > > I think we've got to the point where arguing about our divergent > > use requirements shows the default should be 0600 and every command > > enabled so that whatever changes the device to 0666 also applies > > the command > > Well, that is what we already have with /dev/tpm0. Except that doesn't have the RM. > I'm very surprised by this level of disagreement, so I'm inclined to > drop the idea that the kernel can directly support a 0666 cdev at > all. Great. We'll keep it at 0600 and let userspace sort it out; that way policy becomes flexible too. > Lets stick with the user space broker process and just introduce > enough kernel RM to enable co-existance with kernel users and clean > -up on crash. This should be enough to make a user space broker much > simpler. I wouldn't go that far. I'm still planning a userspace tss2 without any access broker daemon, but let's see how far I get on top of the RM. I think building in stages is a good way to get actual use experience to guide the next stage. > So Jarkko's uapi is basically fine.. No need for a kernel white > list/etc I suspect we'll eventually get to needing one, but I'm happy to begin without and see what that experience tells us before we try to build it. This is actually a better way of doing stuff because we can add to an API based on what we find in the field; the hard thing is pulling back an API that doesn't work. > I had really hoped we could have a secure default 0666 cdev that > would be able to support the basic use of your user space plugins > without a daemon :( I think we can; I just don't think we can define a single in-kernel use policy that supports everyone's use case, so punting to userspace and letting it sort out the desired policy for the platform will work for everyone. James