lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:	Tue, 27 Oct 2009 12:36:47 -0400
From:	Eric Paris <eparis@...hat.com>
To:	David Safford <safford@...son.ibm.com>
Cc:	Eric Paris <eparis@...isplace.org>,
	Mimi Zohar <zohar@...ux.vnet.ibm.com>,
	linux-kernel@...r.kernel.org, James Morris <jmorris@...ei.org>,
	Rajiv Andrade <srajiv@...ux.vnet.ibm.com>,
	Jean-Christophe Dubois <jcd@...budubois.net>,
	Mimi Zohar <zohar@...ibm.com>,
	Stable Kernel <stable@...nel.org>
Subject: Re: [PATCH] ima: remove ACPI dependency

On Tue, 2009-10-27 at 11:59 -0400, David Safford wrote:
> On Tue, 2009-10-27 at 09:58 -0400, Eric Paris wrote:
> > On Mon, Oct 26, 2009 at 9:26 AM, Mimi Zohar <zohar@...ux.vnet.ibm.com> wrote:
> > > Remove ACPI dependency on systems without a TPM enabled.
> > 
> > I'm confused why you need ACPI at all.  The TPM code doesn't require
> > ACPI (I wish it did but Alan Cox Nak'd that patch).  I don't see acpi
> > anywhere in the ima code.  What's the problem we are solving?  Why
> > does IMA care about ACPI at all?  And aren't you really just dropping
> > the build requirement on TCG_TPM?  Is that a great idea?
> > 
> > -Eric
> 
> This is discussed in the LSM thread:
> http://marc.info/?l=linux-security-module&m=125322062401677&w=2
> 
> Basically, if running on a system with a TPM, IMA wants the TPM
> boot measurement log, which the TPM driver can only get through
> ACPI. If the platform does not have a TPM, then IMA does not 
> need ACPI.

I'm afraid I'm not seeing the connection.  Where does IMA gets the boot
measurement log?  I see that the TPM exports that log in securityfs as 2
files (ascii and binary) in tpm_bios.c but I don't see how IMA ever
makes use of that log either internally to the kernel or through the
securityfs files.

If I'm missing it, and IMA is getting and making use of the bios boot
log I think we need to instead make the TPM code send a reasonable
failure code without ACPI and IMA should be changed to handle it.  I
really don't like the obscure ACPI requirement.

-Eric

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Powered by blists - more mailing lists