From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from bedivere.hansenpartnership.com ([66.63.167.143]:50798 "EHLO bedivere.hansenpartnership.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754554AbeEHPg1 (ORCPT ); Tue, 8 May 2018 11:36:27 -0400 Message-ID: <1525793785.3672.12.camel@HansenPartnership.com> Subject: Re: [PATCH v3 2/2] usb: misc: xapea00x: perform platform initialization of TPM From: James Bottomley To: "David R. Bild" Cc: Jarkko Sakkinen , philip.b.tricca@intel.com, Jason Gunthorpe , Greg Kroah-Hartman , Peter Huewe , linux-usb@vger.kernel.org, linux-integrity@vger.kernel.org Date: Tue, 08 May 2018 08:36:25 -0700 In-Reply-To: References: <20180430125418.31344-1-david.bild@xaptum.com> <20180504130022.5231-3-david.bild@xaptum.com> <20180504190638.ikqhdvcqccakzdjd@ziepe.ca> <20180508105515.GB6132@linux.intel.com> <1525793148.3672.8.camel@HansenPartnership.com> Content-Type: text/plain; charset="UTF-8" Mime-Version: 1.0 Sender: linux-integrity-owner@vger.kernel.org List-ID: On Tue, 2018-05-08 at 10:29 -0500, David R. Bild wrote: > On Tue, May 8, 2018 at 10:25 AM, James Bottomley > wrote: > > > > > On Fri, May 04, 2018 at 02:56:25PM -0500, David R. Bild wrote: > > > > [...] > > > > In particular, it sets the credentials for the platform > > > > hierarchy. > > > > The platform hierarchy is essentially the "root" account of the > > > > TPM, so it's critical that those credentials be set before the > > > > TPM > > > > is exposed to user-space. (The platform credentials aren't > > > > persisted in the TPM and must be set by the platform on every > > > > boot.) If the driver registers the TPM before doing > > > > initialization, there's a chance that something else could > > > > access > > > > the TPM before the platform credentials get set. > > > > I don't see any reason to set an unreachable password for the > > platform > > hierarchy if the UEFI didn't. If the desire is to disable the > > platform > > hierarchy, then it should be disabled, not have a random password > > set. > > "Set random password and throw away the key" was my way of disabling > the platform hierarchy. Is there a better way of doing that? Well, yes, use TPM2_HierarchyControl to set phEnable to CLEAR. > > I'd also say this is probably the job of early boot based on > > policy. > > Agreed. And since this card has no "early boot", the driver/kernel > need to do it. Early boot means userspace. for a hot pluggable device, this would probably be something in udev if you follow the no-daemon model and the daemon could do it if you do follow the daemon model. James From mboxrd@z Thu Jan 1 00:00:00 1970 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 Subject: [v3,2/2] usb: misc: xapea00x: perform platform initialization of TPM From: James Bottomley Message-Id: <1525793785.3672.12.camel@HansenPartnership.com> Date: Tue, 08 May 2018 08:36:25 -0700 To: "David R. Bild" Cc: Jarkko Sakkinen , philip.b.tricca@intel.com, Jason Gunthorpe , Greg Kroah-Hartman , Peter Huewe , linux-usb@vger.kernel.org, linux-integrity@vger.kernel.org List-ID: T24gVHVlLCAyMDE4LTA1LTA4IGF0IDEwOjI5IC0wNTAwLCBEYXZpZCBSLiBCaWxkIHdyb3RlOgo+ IE9uIFR1ZSwgTWF5IDgsIDIwMTggYXQgMTA6MjUgQU0sIEphbWVzIEJvdHRvbWxleQo+IDxKYW1l cy5Cb3R0b21sZXlAaGFuc2VucGFydG5lcnNoaXAuY29tPiB3cm90ZToKPiA+IAo+ID4gPiBPbiBG cmksIE1heSAwNCwgMjAxOCBhdCAwMjo1NjoyNVBNIC0wNTAwLCBEYXZpZCBSLiBCaWxkIHdyb3Rl Ogo+ID4gCj4gPiBbLi4uXQo+ID4gPiA+IEluIHBhcnRpY3VsYXIsIGl0IHNldHMgdGhlIGNyZWRl bnRpYWxzIGZvciB0aGUgcGxhdGZvcm0KPiA+ID4gPiBoaWVyYXJjaHkuCj4gPiA+ID4gVGhlIHBs YXRmb3JtIGhpZXJhcmNoeSBpcyBlc3NlbnRpYWxseSB0aGUgInJvb3QiIGFjY291bnQgb2YgdGhl Cj4gPiA+ID4gVFBNLCBzbyBpdCdzIGNyaXRpY2FsIHRoYXQgdGhvc2UgY3JlZGVudGlhbHMgYmUg c2V0IGJlZm9yZSB0aGUKPiA+ID4gPiBUUE0KPiA+ID4gPiBpcyBleHBvc2VkIHRvIHVzZXItc3Bh Y2UuwqDCoChUaGUgcGxhdGZvcm0gY3JlZGVudGlhbHMgYXJlbid0Cj4gPiA+ID4gcGVyc2lzdGVk IGluIHRoZSBUUE0gYW5kIG11c3QgYmUgc2V0IGJ5IHRoZSBwbGF0Zm9ybSBvbiBldmVyeQo+ID4g PiA+IGJvb3QuKcKgwqBJZiB0aGUgZHJpdmVyIHJlZ2lzdGVycyB0aGUgVFBNIGJlZm9yZSBkb2lu Zwo+ID4gPiA+IGluaXRpYWxpemF0aW9uLCB0aGVyZSdzIGEgY2hhbmNlIHRoYXQgc29tZXRoaW5n IGVsc2UgY291bGQKPiA+ID4gPiBhY2Nlc3MKPiA+ID4gPiB0aGUgVFBNIGJlZm9yZSB0aGUgcGxh dGZvcm0gY3JlZGVudGlhbHMgZ2V0IHNldC4KPiA+IAo+ID4gSSBkb24ndCBzZWUgYW55IHJlYXNv biB0byBzZXQgYW4gdW5yZWFjaGFibGUgcGFzc3dvcmQgZm9yIHRoZQo+ID4gcGxhdGZvcm0KPiA+ IGhpZXJhcmNoeSBpZiB0aGUgVUVGSSBkaWRuJ3QuwqDCoElmIHRoZSBkZXNpcmUgaXMgdG8gZGlz YWJsZSB0aGUKPiA+IHBsYXRmb3JtCj4gPiBoaWVyYXJjaHksIHRoZW4gaXQgc2hvdWxkIGJlIGRp c2FibGVkLCBub3QgaGF2ZSBhIHJhbmRvbSBwYXNzd29yZAo+ID4gc2V0Lgo+IAo+ICJTZXQgcmFu ZG9tIHBhc3N3b3JkIGFuZCB0aHJvdyBhd2F5IHRoZSBrZXkiIHdhcyBteSB3YXkgb2YgZGlzYWJs aW5nCj4gdGhlIHBsYXRmb3JtIGhpZXJhcmNoeS7CoMKgSXMgdGhlcmUgYSBiZXR0ZXIgd2F5IG9m IGRvaW5nIHRoYXQ/CgpXZWxsLCB5ZXMsIHVzZSBUUE0yX0hpZXJhcmNoeUNvbnRyb2wgdG8gc2V0 IHBoRW5hYmxlIHRvIENMRUFSLgoKPiA+IEknZCBhbHNvIHNheSB0aGlzIGlzIHByb2JhYmx5IHRo ZSBqb2Igb2YgZWFybHkgYm9vdCBiYXNlZCBvbgo+ID4gcG9saWN5Lgo+IAo+IEFncmVlZC7CoMKg QW5kIHNpbmNlIHRoaXMgY2FyZCBoYXMgbm8gImVhcmx5IGJvb3QiLCB0aGUgZHJpdmVyL2tlcm5l bAo+IG5lZWQgdG8gZG8gaXQuCgpFYXJseSBib290IG1lYW5zIHVzZXJzcGFjZS4gZm9yIGEgaG90 IHBsdWdnYWJsZSBkZXZpY2UsIHRoaXMgd291bGQKcHJvYmFibHkgYmUgc29tZXRoaW5nIGluIHVk ZXYgaWYgeW91IGZvbGxvdyB0aGUgbm8tZGFlbW9uIG1vZGVsIGFuZCB0aGUKZGFlbW9uIGNvdWxk IGRvIGl0IGlmIHlvdSBkbyBmb2xsb3cgdGhlIGRhZW1vbiBtb2RlbC4KCkphbWVzCi0tLQpUbyB1 bnN1YnNjcmliZSBmcm9tIHRoaXMgbGlzdDogc2VuZCB0aGUgbGluZSAidW5zdWJzY3JpYmUgbGlu dXgtdXNiIiBpbgp0aGUgYm9keSBvZiBhIG1lc3NhZ2UgdG8gbWFqb3Jkb21vQHZnZXIua2VybmVs Lm9yZwpNb3JlIG1ham9yZG9tbyBpbmZvIGF0ICBodHRwOi8vdmdlci5rZXJuZWwub3JnL21ham9y ZG9tby1pbmZvLmh0bWwK