linux-kernel - Re: [RFC PATCH] tpm: don't return -EINVAL if TPM command validation fails

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 17 Nov 2017 11:17:34 -0700
From:   Jason Gunthorpe <jgg@...pe.ca>
To:     Javier Martinez Canillas <javierm@...hat.com>
Cc:     linux-kernel@...r.kernel.org,
        Jarkko Sakkinen <jarkko.sakkinen@...ux.intel.com>,
        Peter Huewe <peterhuewe@....de>,
        Philip Tricca <philip.b.tricca@...el.com>,
        linux-integrity@...r.kernel.org,
        William Roberts <william.c.roberts@...el.com>
Subject: Re: [RFC PATCH] tpm: don't return -EINVAL if TPM command validation
 fails

On Fri, Nov 17, 2017 at 07:10:09PM +0100, Javier Martinez Canillas wrote:

> Right, that's what I understood indeed but wanted to be sure. The problem with
> that approach is that would not scale.
> 
> Since this particular TPM2 doesn't have support for the TPM2_EncryptDecrypt2
> command, but some chips may not support others commands.

No, tpm_validate is not supposed to be sensitive to what commands the
TPM supports. It is only supposed to check if the command passed is
fully understood by the kernel and is properly formed.

This is to prevent rouge user space from sending garbage or privileged
commands to the TPM.

If it is refusing TPM2_EncryptDecrypt2, and that command is safe to
use in the spaces system, then tpm_validate must learn how to handle
it, or userspace can never use it.

Jason