linux-kernel - Re: ima - wait for tpm load

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Mon, 28 Jun 2021 18:04:19 -0400
From:   Ken Goldman <kgold@...ux.ibm.com>
To:     Mimi Zohar <zohar@...ux.ibm.com>,
        "Jorge Ramirez-Ortiz, Foundries" <jorge@...ndries.io>
Cc:     dmitry.kasatkin@...il.com, jmorris@...ei.org, serge@...lyn.com,
        linux-integrity@...r.kernel.org,
        linux-security-module@...r.kernel.org,
        linux-kernel@...r.kernel.org, Jarkko Sakkinen <jarkko@...nel.org>
Subject: Re: ima - wait for tpm load

On 6/10/2021 4:31 PM, Mimi Zohar wrote:
> As I recall "extend" works pretty much from the beginning.  There's no
> need to wait for the self test to complete.   Registering the TPM early
> might be enough without having to wait.  Or maybe check the selftest
> result.

TPM 2.0 depends somewhat on the type of self test - there are several
options.  They will in some sense block other commands that use
the angorithm.

The TPM is permitted to do an extend before the hash algorithm is
tested (just not return a result) but I don't think it's required.

So:

- self test
- extend

may permit the extend to proceed while the self test is
happening, but it may not.

Download attachment "smime.p7s" of type "application/pkcs7-signature" (4490 bytes)