From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S939017AbdAEWVy (ORCPT ); Thu, 5 Jan 2017 17:21:54 -0500 Received: from quartz.orcorp.ca ([184.70.90.242]:45929 "EHLO quartz.orcorp.ca" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S939007AbdAEWVZ (ORCPT ); Thu, 5 Jan 2017 17:21:25 -0500 Date: Thu, 5 Jan 2017 15:21:18 -0700 From: Jason Gunthorpe To: James Bottomley Cc: "tpmdd-devel@lists.sourceforge.net" , "linux-security-module@vger.kernel.org" , open list Subject: Re: [tpmdd-devel] [PATCH RFC 0/4] RFC: in-kernel resource manager Message-ID: <20170105222118.GC31047@obsidianresearch.com> References: <20170102132213.22880-1-jarkko.sakkinen@linux.intel.com> <9F48E1A823B03B4790B7E6E69430724DC7C149F6@exch2010c.sit.fraunhofer.de> <20170105172726.GA11680@obsidianresearch.com> <1483641223.2515.62.camel@linux.vnet.ibm.com> <20170105192025.GB12587@obsidianresearch.com> <1483646149.2515.83.camel@linux.vnet.ibm.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1483646149.2515.83.camel@linux.vnet.ibm.com> User-Agent: Mutt/1.5.24 (2015-08-30) X-Broken-Reverse-DNS: no host name found for IP address 10.0.0.156 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Thu, Jan 05, 2017 at 11:55:49AM -0800, James Bottomley wrote: > We don't really have that choice: Keys require authorization, so you > have to have an auth session. I know, this is why I suggested a combo op (kernel level atomicity is clearly DOS safe).. > If you want things like PCR sealed or time limited keys, you don't > really have a choice on policy sessions either. .. and advanced stuff like is what I was talking about giving up for unpriv if it can't be allowed safely ... > I think we've got to the point where arguing about our divergent use > requirements shows the default should be 0600 and every command enabled > so that whatever changes the device to 0666 also applies the command Well, that is what we already have with /dev/tpm0. I'm very surprised by this level of disagreement, so I'm inclined to drop the idea that the kernel can directly support a 0666 cdev at all. Lets stick with the user space broker process and just introduce enough kernel RM to enable co-existance with kernel users and clean-up on crash. This should be enough to make a user space broker much simpler. So Jarkko's uapi is basically fine.. No need for a kernel white list/etc I had really hoped we could have a secure default 0666 cdev that would be able to support the basic use of your user space plugins without a daemon :( Jason