From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1032947AbdAETxZ (ORCPT ); Thu, 5 Jan 2017 14:53:25 -0500 Received: from quartz.orcorp.ca ([184.70.90.242]:43795 "EHLO quartz.orcorp.ca" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753294AbdAETxP (ORCPT ); Thu, 5 Jan 2017 14:53:15 -0500 Date: Thu, 5 Jan 2017 12:20:25 -0700 From: Jason Gunthorpe To: James Bottomley Cc: "Fuchs, Andreas" , "linux-security-module@vger.kernel.org" , "tpmdd-devel@lists.sourceforge.net" , open list Subject: Re: [tpmdd-devel] [PATCH RFC 0/4] RFC: in-kernel resource manager Message-ID: <20170105192025.GB12587@obsidianresearch.com> References: <20170102132213.22880-1-jarkko.sakkinen@linux.intel.com> <9F48E1A823B03B4790B7E6E69430724DC7C149F6@exch2010c.sit.fraunhofer.de> <20170105172726.GA11680@obsidianresearch.com> <1483641223.2515.62.camel@linux.vnet.ibm.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1483641223.2515.62.camel@linux.vnet.ibm.com> User-Agent: Mutt/1.5.24 (2015-08-30) X-Broken-Reverse-DNS: no host name found for IP address 10.0.0.156 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Thu, Jan 05, 2017 at 10:33:43AM -0800, James Bottomley wrote: > > A combo ioctl that could setup the session, issue an operation in it > > and then delete the session, for instance. > > This would work for encryption or HMAC sessions, but probably not for > policy sessions, because they can have an arbitrarily large command > sequence to construct them. I'd rather give up features (eg policy sessions, if necessary) for the unpriv fd than give up security of the unpriv fd. We always have the out that special stuff can go down the priv path. > The other issue we're likely to run into if we do it this way is > delayed error reporting. Not sure I follow. > How about a more traditional approach which would be leasing (basically > what we use for NFS). Any application opening a session would have Doesn't this just change the DOS vector? Now the attacker has to delay execution of TPM commands long enough to force session leases to time out. That isn't too hard to do, asking the TPM to make a RSA key can take seconds, for instance. Jason