linux-kernel - Re: [RFC PATCH] tpm: don't return -EINVAL if TPM command validation fails

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20171117175834.GK4276@ziepe.ca>
Date:   Fri, 17 Nov 2017 10:58:34 -0700
From:   Jason Gunthorpe <jgg@...pe.ca>
To:     Javier Martinez Canillas <javierm@...hat.com>
Cc:     linux-kernel@...r.kernel.org,
        Jarkko Sakkinen <jarkko.sakkinen@...ux.intel.com>,
        Peter Huewe <peterhuewe@....de>,
        Philip Tricca <philip.b.tricca@...el.com>,
        linux-integrity@...r.kernel.org,
        William Roberts <william.c.roberts@...el.com>
Subject: Re: [RFC PATCH] tpm: don't return -EINVAL if TPM command validation
 fails

On Fri, Nov 17, 2017 at 06:56:09PM +0100, Javier Martinez Canillas wrote:

> Yes, the problem with that is user-space not having enough information about
> what went wrong. Right now the TCTI layer just reports TSS2_BASE_RC_IO_ERROR
> in this case and can't be blamed.

Well, if you care about the differnce between a transport failure and
a kernel rejection due to validation, then it needs to report a
different code :)

> > Regarding your specific issue, can you make the command you want to
> > use validate? Would that make sense?
> 
> Sorry, I'm not sure to understand what you meant. Could you please elaborate?

Make it so tpm_validate will accept the command being sent.

Jason