From: Stefan Berger <stefanb@linux.vnet.ibm.com>
To: Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
Cc: tpmdd-devel@lists.sourceforge.net,
jarkko.sakkinen@linux.intel.com, linux-kernel@vger.kernel.org,
linux-security-module@vger.kernel.org
Subject: Re: [PATCH] tpm: vtpm_proxy: Introduce flag to prevent sysfs entries
Date: Fri, 24 Jun 2016 14:43:00 -0400 [thread overview]
Message-ID: <576D7F34.50201@linux.vnet.ibm.com> (raw)
In-Reply-To: <20160624174803.GA14506@obsidianresearch.com>
On 06/24/2016 01:48 PM, Jason Gunthorpe wrote:
> On Fri, Jun 24, 2016 at 10:36:55AM -0400, Stefan Berger wrote:
>> Introduce TPM_VTPM_PROXY_NO_SYSFS flag that prevents a vtpm_proxy driver
>> instance from having the typical sysfs entries that shows the state of the
>> TPM. The flag is to be set in the ioctl creating the vtpm_proxy device
>> pair and maps on a new chip flags TPM_CHIP_FLAG_NO_SYSFS.
> No other subsystem does something so goofy, this really needs to be
> part of namespace support for TPM.
And I am not sure how to go about this. TPM2 by the way doesn't have
such entries, so it's much better from that perspective.
>
> Why can't you just make the sysfs files unreadable in user space?
There are actually ways to go about this. Likely bind-mounting over
/sys/device/virtual/tpm would be one solution to hide all virtual TPM
device. Another is applying an AppArmor policy to the container denying
access to tpm directories or entries. SELinux would not be so easy.
The flag in this patch seemed like a 'cheap' way to eliminate that
problem as well.
> If a container can make them readable again can't it also just create
> the chardev node?
What do you mean by making them readable again? The chardev node can be
created inside the container with the major and minor numbers as it was
created with the ioctl.
Stefan
>
> Jason
>
next prev parent reply other threads:[~2016-06-24 18:43 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-06-24 14:36 [PATCH] tpm: vtpm_proxy: Introduce flag to prevent sysfs entries Stefan Berger
2016-06-24 17:48 ` Jason Gunthorpe
2016-06-24 18:43 ` Stefan Berger [this message]
2016-06-24 19:47 ` Jason Gunthorpe
2016-06-27 18:32 ` Jarkko Sakkinen
2016-06-30 16:17 ` Stefan Berger
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=576D7F34.50201@linux.vnet.ibm.com \
--to=stefanb@linux.vnet.ibm.com \
--cc=jarkko.sakkinen@linux.intel.com \
--cc=jgunthorpe@obsidianresearch.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=tpmdd-devel@lists.sourceforge.net \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).