From: James Bottomley <James.Bottomley@HansenPartnership.com>
To: Tadeusz Struk <tadeusz.struk@intel.com>, jarkko.sakkinen@linux.intel.com
Cc: peterz@infradead.org, linux-kernel@vger.kernel.org, jgg@ziepe.ca,
mingo@redhat.com, jeffrin@rajagiritech.edu.in,
linux-integrity@vger.kernel.org, will@kernel.org,
peterhuewe@gmx.de
Subject: Re: [PATCH =v2 3/3] tpm: selftest: cleanup after unseal with wrong auth/policy test
Date: Thu, 12 Dec 2019 14:51:03 -0500 [thread overview]
Message-ID: <1576180263.10287.4.camel@HansenPartnership.com> (raw)
In-Reply-To: <157617293957.8172.1404790695313599409.stgit@tstruk-mobl1>
On Thu, 2019-12-12 at 09:48 -0800, Tadeusz Struk wrote:
> Unseal with wrong auth or wrong policy test affects DA lockout
> and eventually causes the tests to fail with:
> "ProtocolError: TPM_RC_LOCKOUT: rc=0x00000921"
> when the tests run multiple times.
> Send tpm clear command after the test to reset the DA counters.
>
> Signed-off-by: Tadeusz Struk <tadeusz.struk@intel.com>
> ---
> tools/testing/selftests/tpm2/test_smoke.sh | 5 +++++
> 1 file changed, 5 insertions(+)
>
> diff --git a/tools/testing/selftests/tpm2/test_smoke.sh
> b/tools/testing/selftests/tpm2/test_smoke.sh
> index cb54ab637ea6..8155c2ea7ccb 100755
> --- a/tools/testing/selftests/tpm2/test_smoke.sh
> +++ b/tools/testing/selftests/tpm2/test_smoke.sh
> @@ -3,3 +3,8 @@
>
> python -m unittest -v tpm2_tests.SmokeTest
> python -m unittest -v tpm2_tests.AsyncTest
> +
> +CLEAR_CMD=$(which tpm2_clear)
> +if [ -n $CLEAR_CMD ]; then
> + tpm2_clear -T device
> +fi
TPM2_Clear reprovisions the SPS ... that would make all currently
exported TPM keys go invalid. I know these tests should be connected
to a vTPM, so doing this should be safe, but if this accidentally got
executed on your laptop all TPM relying functions would be disrupted,
which doesn't seem to be the best thing to hard wire into a test.
What about doing a TPM2_DictionaryAttackLockReset instead, which is the
least invasive route to fixing the problem ... provided you know what
the lockout authorization is.
James
next prev parent reply other threads:[~2019-12-12 19:51 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-12-12 17:48 [PATCH =v2 1/3] tpm: fix invalid locking in NONBLOCKING mode Tadeusz Struk
2019-12-12 17:48 ` [PATCH =v2 2/3] tpm: selftest: add test covering async mode Tadeusz Struk
2019-12-17 1:55 ` Jarkko Sakkinen
2019-12-12 17:48 ` [PATCH =v2 3/3] tpm: selftest: cleanup after unseal with wrong auth/policy test Tadeusz Struk
2019-12-12 19:51 ` James Bottomley [this message]
2019-12-12 20:49 ` Tadeusz Struk
2019-12-12 20:54 ` James Bottomley
2019-12-12 21:07 ` Tadeusz Struk
2019-12-12 21:11 ` James Bottomley
2019-12-17 10:37 ` Jarkko Sakkinen
2019-12-17 1:32 ` [PATCH =v2 1/3] tpm: fix invalid locking in NONBLOCKING mode Jarkko Sakkinen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1576180263.10287.4.camel@HansenPartnership.com \
--to=james.bottomley@hansenpartnership.com \
--cc=jarkko.sakkinen@linux.intel.com \
--cc=jeffrin@rajagiritech.edu.in \
--cc=jgg@ziepe.ca \
--cc=linux-integrity@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mingo@redhat.com \
--cc=peterhuewe@gmx.de \
--cc=peterz@infradead.org \
--cc=tadeusz.struk@intel.com \
--cc=will@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).