From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]:42298 "EHLO mx0a-001b2d01.pphosted.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1751333AbeCLXTu (ORCPT ); Mon, 12 Mar 2018 19:19:50 -0400 Received: from pps.filterd (m0098420.ppops.net [127.0.0.1]) by mx0b-001b2d01.pphosted.com (8.16.0.22/8.16.0.22) with SMTP id w2CNJFE3026674 for ; Mon, 12 Mar 2018 19:19:50 -0400 Received: from e06smtp13.uk.ibm.com (e06smtp13.uk.ibm.com [195.75.94.109]) by mx0b-001b2d01.pphosted.com with ESMTP id 2gnx6y2g1k-1 (version=TLSv1.2 cipher=AES256-SHA256 bits=256 verify=NOT) for ; Mon, 12 Mar 2018 19:19:50 -0400 Received: from localhost by e06smtp13.uk.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Mon, 12 Mar 2018 23:19:48 -0000 Subject: Re: [PATCH] security: Fix IMA Kconfig for dependencies on ARM64 From: Mimi Zohar To: Jason Gunthorpe Cc: James Bottomley , Jiandi An , dmitry.kasatkin@gmail.com, jmorris@namei.org, serge@hallyn.com, linux-integrity@vger.kernel.org, linux-ima-devel@lists.sourceforge.net, linux-ima-user@lists.sourceforge.net, linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org, David Safford Date: Mon, 12 Mar 2018 19:19:42 -0400 In-Reply-To: <20180312230501.GJ24717@ziepe.ca> References: <1520448953.10396.565.camel@linux.vnet.ibm.com> <1520449719.5558.28.camel@HansenPartnership.com> <1520450495.10396.587.camel@linux.vnet.ibm.com> <1520451662.24314.5.camel@HansenPartnership.com> <1520461156.10396.654.camel@linux.vnet.ibm.com> <191cfd49-0c66-a5ef-3d2b-b6c4132aa294@codeaurora.org> <1520615461.12216.6.camel@HansenPartnership.com> <1520891598.3547.190.camel@linux.vnet.ibm.com> <20180312215957.GI24717@ziepe.ca> <1520895525.3547.226.camel@linux.vnet.ibm.com> <20180312230501.GJ24717@ziepe.ca> Content-Type: text/plain; charset="UTF-8" Mime-Version: 1.0 Message-Id: <1520896782.3547.245.camel@linux.vnet.ibm.com> Sender: linux-integrity-owner@vger.kernel.org List-ID: On Mon, 2018-03-12 at 17:05 -0600, Jason Gunthorpe wrote: > On Mon, Mar 12, 2018 at 06:58:45PM -0400, Mimi Zohar wrote: > > On Mon, 2018-03-12 at 15:59 -0600, Jason Gunthorpe wrote: > > > On Mon, Mar 12, 2018 at 05:53:18PM -0400, Mimi Zohar wrote: > > > > > > > Using Kconfig to force the TPM to be builtin is not required, but > > > > helpful. Users interested in IMA-measurement could configure the TPM > > > > as builtin themselves. Without the TPM builtin, IMA goes into TPM- > > > > bypass mode. > > > > > > This issues, broadly speaking, we have lots of TPM drivers, selecting > > > only some to actually support IMA shows we have some kind of problem > > > here. > > > > True, IMA is not selecting the older TPM vendor specific modules, but > > only the newer TPM_TIS and now TPM_CRB modules. That doesn't imply > > that IMA only supports some TPMs. It means that by default, these > > TPMs are builtin. Anyone building a kernel, can select the vendor > > specific TPM to be builtin. > > That doesn't help distros, which is the main point of the complaint > with this scheme :) Years ago because of faulty TPM drivers, IMA was disabled in one of the main distro's. Deciding which vendor specific TPMs should be builtin, is a discussion between the distro's and TPM vendors. Mimi From mboxrd@z Thu Jan 1 00:00:00 1970 From: zohar@linux.vnet.ibm.com (Mimi Zohar) Date: Mon, 12 Mar 2018 19:19:42 -0400 Subject: [PATCH] security: Fix IMA Kconfig for dependencies on ARM64 In-Reply-To: <20180312230501.GJ24717@ziepe.ca> References: <1520448953.10396.565.camel@linux.vnet.ibm.com> <1520449719.5558.28.camel@HansenPartnership.com> <1520450495.10396.587.camel@linux.vnet.ibm.com> <1520451662.24314.5.camel@HansenPartnership.com> <1520461156.10396.654.camel@linux.vnet.ibm.com> <191cfd49-0c66-a5ef-3d2b-b6c4132aa294@codeaurora.org> <1520615461.12216.6.camel@HansenPartnership.com> <1520891598.3547.190.camel@linux.vnet.ibm.com> <20180312215957.GI24717@ziepe.ca> <1520895525.3547.226.camel@linux.vnet.ibm.com> <20180312230501.GJ24717@ziepe.ca> Message-ID: <1520896782.3547.245.camel@linux.vnet.ibm.com> To: linux-security-module@vger.kernel.org List-Id: linux-security-module.vger.kernel.org On Mon, 2018-03-12 at 17:05 -0600, Jason Gunthorpe wrote: > On Mon, Mar 12, 2018 at 06:58:45PM -0400, Mimi Zohar wrote: > > On Mon, 2018-03-12 at 15:59 -0600, Jason Gunthorpe wrote: > > > On Mon, Mar 12, 2018 at 05:53:18PM -0400, Mimi Zohar wrote: > > > > > > > Using Kconfig to force the TPM to be builtin is not required, but > > > > helpful. ?Users interested in IMA-measurement could configure the TPM > > > > as builtin themselves. ?Without the TPM builtin, IMA goes into TPM- > > > > bypass mode. > > > > > > This issues, broadly speaking, we have lots of TPM drivers, selecting > > > only some to actually support IMA shows we have some kind of problem > > > here. > > > > True, IMA is not selecting the older TPM vendor specific modules, but > > only the newer TPM_TIS and now TPM_CRB modules. ?That doesn't imply > > that IMA only supports some TPMs. ?It means that by default, these > > TPMs are builtin. ?Anyone building a kernel, can select the vendor > > specific TPM to be builtin. > > That doesn't help distros, which is the main point of the complaint > with this scheme :) Years ago because of faulty TPM drivers, IMA was disabled in one of the main distro's. ?Deciding which vendor specific TPMs should be builtin, is a discussion between the distro's and TPM vendors. Mimi -- To unsubscribe from this list: send the line "unsubscribe linux-security-module" in the body of a message to majordomo at vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751690AbeCLXTx (ORCPT ); Mon, 12 Mar 2018 19:19:53 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]:51272 "EHLO mx0a-001b2d01.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751450AbeCLXTv (ORCPT ); Mon, 12 Mar 2018 19:19:51 -0400 Subject: Re: [PATCH] security: Fix IMA Kconfig for dependencies on ARM64 From: Mimi Zohar To: Jason Gunthorpe Cc: James Bottomley , Jiandi An , dmitry.kasatkin@gmail.com, jmorris@namei.org, serge@hallyn.com, linux-integrity@vger.kernel.org, linux-ima-devel@lists.sourceforge.net, linux-ima-user@lists.sourceforge.net, linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org, David Safford Date: Mon, 12 Mar 2018 19:19:42 -0400 In-Reply-To: <20180312230501.GJ24717@ziepe.ca> References: <1520448953.10396.565.camel@linux.vnet.ibm.com> <1520449719.5558.28.camel@HansenPartnership.com> <1520450495.10396.587.camel@linux.vnet.ibm.com> <1520451662.24314.5.camel@HansenPartnership.com> <1520461156.10396.654.camel@linux.vnet.ibm.com> <191cfd49-0c66-a5ef-3d2b-b6c4132aa294@codeaurora.org> <1520615461.12216.6.camel@HansenPartnership.com> <1520891598.3547.190.camel@linux.vnet.ibm.com> <20180312215957.GI24717@ziepe.ca> <1520895525.3547.226.camel@linux.vnet.ibm.com> <20180312230501.GJ24717@ziepe.ca> Content-Type: text/plain; charset="UTF-8" X-Mailer: Evolution 3.20.5 (3.20.5-1.fc24) Mime-Version: 1.0 Content-Transfer-Encoding: 8bit X-TM-AS-GCONF: 00 x-cbid: 18031223-0012-0000-0000-000005BD15EE X-IBM-AV-DETECTION: SAVI=unused REMOTE=unused XFE=unused x-cbparentid: 18031223-0013-0000-0000-00001939166B Message-Id: <1520896782.3547.245.camel@linux.vnet.ibm.com> X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:,, definitions=2018-03-12_14:,, signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 malwarescore=0 suspectscore=3 phishscore=0 bulkscore=0 spamscore=0 clxscore=1015 lowpriorityscore=0 impostorscore=0 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1709140000 definitions=main-1803120254 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Mon, 2018-03-12 at 17:05 -0600, Jason Gunthorpe wrote: > On Mon, Mar 12, 2018 at 06:58:45PM -0400, Mimi Zohar wrote: > > On Mon, 2018-03-12 at 15:59 -0600, Jason Gunthorpe wrote: > > > On Mon, Mar 12, 2018 at 05:53:18PM -0400, Mimi Zohar wrote: > > > > > > > Using Kconfig to force the TPM to be builtin is not required, but > > > > helpful.  Users interested in IMA-measurement could configure the TPM > > > > as builtin themselves.  Without the TPM builtin, IMA goes into TPM- > > > > bypass mode. > > > > > > This issues, broadly speaking, we have lots of TPM drivers, selecting > > > only some to actually support IMA shows we have some kind of problem > > > here. > > > > True, IMA is not selecting the older TPM vendor specific modules, but > > only the newer TPM_TIS and now TPM_CRB modules.  That doesn't imply > > that IMA only supports some TPMs.  It means that by default, these > > TPMs are builtin.  Anyone building a kernel, can select the vendor > > specific TPM to be builtin. > > That doesn't help distros, which is the main point of the complaint > with this scheme :) Years ago because of faulty TPM drivers, IMA was disabled in one of the main distro's.  Deciding which vendor specific TPMs should be builtin, is a discussion between the distro's and TPM vendors. Mimi