linux-kernel - Re: [tpmdd-devel] [PATCH] TPM: Fixup pubek sysfs file

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 14 Sep 2009 12:43:36 -0600
From:	Jason Gunthorpe <jgunthorpe@...idianresearch.com>
To:	Rajiv Andrade <srajiv@...ux.vnet.ibm.com>
Cc:	"Jonathan M. McCune" <jonmccune@....edu>, Greg KH <greg@...ah.com>,
	linux-kernel@...r.kernel.org, jbeulich@...ell.com,
	jmorris@...ei.org, tpmdd-devel@...ts.sourceforge.net,
	m.selhorst@...rix.com, Andrew Morton <akpm@...ux-foundation.org>,
	Roland Dreier <rdreier@...co.com>
Subject: Re: [tpmdd-devel] [PATCH] TPM: Fixup pubek sysfs file

On Mon, Sep 14, 2009 at 03:34:39PM -0300, Rajiv Andrade wrote:

> > Thus, fixing the one-item-per-file issues seems reasonable to me. For 
> > example, changing /sys/devices/platform/tpm_tis/pcrs from a single
> > multi-entry file to a directory containing files named 0-15 or 0-23 that
> > each then contain only the relevant 20-byte value seems quite
> > reasonable. (Today's TPMs contain either 16 or 24 PCRs but future ones
> > could contain many more.)

> The number of PCRs of a particular TPM can be retrieved sending it the
> TPM_GetCapability command, so it's feasible to build this directory
> structure dynamically (chip independent).

I think as we've seen, keeping the sysfs stuff working has a real
cost. So that should be balanced with an actual need. Further, talking
to the TPM and handling all the parsing properly is a huge complex
pain, it would be better to have this code gone completely.

Can anyone think of a reason why the PCRs should be accessed from
sysfs? I can't. They are only really useful in connection with other
complex TPM operations. Userspace can fully access them using the
relevant TPM calls.

The pubek should definately go, it is useless in 99% of cases.

The caps file should be split up into 'manufacturer' 'tcg_version'
(please include the spec rev too!!) and maybe 'firmware_version'. This
would at least be useful to udev.

Regards,
Jason
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/