linux-kernel - Re: [tpmdd-devel] [PATCH] TPM: Fixup pubek sysfs file

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20090914194626.GF25981@obsidianresearch.com>
Date:	Mon, 14 Sep 2009 13:46:26 -0600
From:	Jason Gunthorpe <jgunthorpe@...idianresearch.com>
To:	"Jonathan M. McCune" <jonmccune@....edu>
Cc:	Rajiv Andrade <srajiv@...ux.vnet.ibm.com>,
	Greg KH <greg@...ah.com>, linux-kernel@...r.kernel.org,
	jbeulich@...ell.com, jmorris@...ei.org,
	tpmdd-devel@...ts.sourceforge.net, m.selhorst@...rix.com,
	Andrew Morton <akpm@...ux-foundation.org>,
	Roland Dreier <rdreier@...co.com>,
	Reiner Sailer <sailer@...ibm.com>
Subject: Re: [tpmdd-devel] [PATCH] TPM: Fixup pubek sysfs file

On Mon, Sep 14, 2009 at 03:23:09PM -0400, Jonathan M. McCune wrote:

>> Can anyone think of a reason why the PCRs should be accessed from
>> sysfs? I can't. They are only really useful in connection with other
>> complex TPM operations. Userspace can fully access them using the
>> relevant TPM calls.
>
> Fair enough, though they are useful in combination with IMA and as a  
> sanity check that the driver is working correctly.
[..]
> IMA can leverage the ability to read and extend PCRs, and its security  
> properties derive from that functionality being a part of the kernel.  
> PCR reading is currently part of the TPM driver in 
> drivers/char/tpm/tpm.c.

Sanzzy

> Thus, to the question, "Can we remove the ability of the kernel to send  
> TPM commands such as GetCapability and PCRRead?" I believe the answer is  
> no. Or at least, not without causing a lot of work for the IMA system.  
> Although it may be worth discussing whether this functionality should be  
> moved from the driver into IMA.

Fair enough, fortunately TPM_PCRRead and TPM_Extend are two of the
simplest commands. As has been done special casing the fixed size
messages is easy and robust.

The pcrs file really isn't that offsensive to me, the PCR registers
can reasonably thought of as a single memory space. If it wasn't for
the PCR-%u prefix I think it would be fine for sysfs??

Ie:

BD ED 7B B2 EB AE BE 31 4E CC 57 82 81 64 FC 8A 09 FA 19 25 
05 37 25 B5 24 59 14 A5 94 1A 42 97 39 E6 07 40 27 3A 7D 48 
3A 3F 78 0F 11 A4 B4 99 69 FC AA 80 CD 6E 39 57 C3 3B 22 75 

not:

PCR-00: BD ED 7B B2 EB AE BE 31 4E CC 57 82 81 64 FC 8A 09 FA 19 25 
PCR-01: 05 37 25 B5 24 59 14 A5 94 1A 42 97 39 E6 07 40 27 3A 7D 48 
PCR-02: 3A 3F 78 0F 11 A4 B4 99 69 FC AA 80 CD 6E 39 57 C3 3B 22 75 

Greg?

Jason
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/