Re: [PATCH RFC 0/4] RFC: in-kernel resource manager

From: Ken Goldman <kgoldman@us.ibm.com>
To: linux-kernel@vger.kernel.org
Cc: tpmdd-devel@lists.sourceforge.net, linux-security-module@vger.kernel.org
Cc: tpmdd-devel@lists.sourceforge.net, linux-kernel@vger.kernel.org
Subject: Re: [PATCH RFC 0/4] RFC: in-kernel resource manager
Date: Tue, 10 Jan 2017 14:03:08 -0500	[thread overview]
Message-ID: <o53b57$ac8$1@blaine.gmane.org> (raw)
In-Reply-To: <20170105192025.GB12587@obsidianresearch.com>

On 1/5/2017 2:20 PM, Jason Gunthorpe wrote:
>
> I'd rather give up features (eg policy sessions, if necessary) for the
> unpriv fd than give up security of the unpriv fd.

Please don't give up policy.  Nearly every use case of that we think of 
for TPM 2.0 uses policy sessions.

E.g.,

In 1.2, PCR authorization was built in to the object.  In 2.0, it's a 
policy.

In 1.2, key types were restricted to certain commands.  In 2.0, it's a 
policy.

Then there are all the new use cases - time restricted keys, use count 
restricted keys, keys with a PIN, etc., all use policy.

Even use of the EK primary key requires a policy, and that's needed for 
salt (getting the first password in securely) and attestation (proof 
that the TPM is authentic).