From: Jason Gunthorpe <jgunthorpe-ePGOBjL8dl3ta4EC/59zMFaTQe2KTcn/@public.gmane.org>
To: Stefan Berger
<stefanb-23VcF4HTsmIX0ybBhKVfKdBPR1lH4CV8@public.gmane.org>
Cc: linux-security-module-u79uwXL29TY76Z2rM5mHXA@public.gmane.org,
tpmdd-devel-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org,
linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
Subject: Re: [PATCH] tpm: vtpm_proxy: Introduce flag to prevent sysfs entries
Date: Fri, 24 Jun 2016 11:48:03 -0600 [thread overview]
Message-ID: <20160624174803.GA14506@obsidianresearch.com> (raw)
In-Reply-To: <1466779015-26965-1-git-send-email-stefanb-23VcF4HTsmIX0ybBhKVfKdBPR1lH4CV8@public.gmane.org>
On Fri, Jun 24, 2016 at 10:36:55AM -0400, Stefan Berger wrote:
> Introduce TPM_VTPM_PROXY_NO_SYSFS flag that prevents a vtpm_proxy driver
> instance from having the typical sysfs entries that shows the state of the
> TPM. The flag is to be set in the ioctl creating the vtpm_proxy device
> pair and maps on a new chip flags TPM_CHIP_FLAG_NO_SYSFS.
No other subsystem does something so goofy, this really needs to be
part of namespace support for TPM.
Why can't you just make the sysfs files unreadable in user space?
If a container can make them readable again can't it also just create
the chardev node?
Jason
------------------------------------------------------------------------------
Attend Shape: An AT&T Tech Expo July 15-16. Meet us at AT&T Park in San
Francisco, CA to explore cutting-edge tech and listen to tech luminaries
present their vision of the future. This family event has something for
everyone, including kids. Get more information and register today.
http://sdm.link/attshape
WARNING: multiple messages have this Message-ID (diff)
From: Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
To: Stefan Berger <stefanb@linux.vnet.ibm.com>
Cc: tpmdd-devel@lists.sourceforge.net,
jarkko.sakkinen@linux.intel.com, linux-kernel@vger.kernel.org,
linux-security-module@vger.kernel.org
Subject: Re: [PATCH] tpm: vtpm_proxy: Introduce flag to prevent sysfs entries
Date: Fri, 24 Jun 2016 11:48:03 -0600 [thread overview]
Message-ID: <20160624174803.GA14506@obsidianresearch.com> (raw)
In-Reply-To: <1466779015-26965-1-git-send-email-stefanb@linux.vnet.ibm.com>
On Fri, Jun 24, 2016 at 10:36:55AM -0400, Stefan Berger wrote:
> Introduce TPM_VTPM_PROXY_NO_SYSFS flag that prevents a vtpm_proxy driver
> instance from having the typical sysfs entries that shows the state of the
> TPM. The flag is to be set in the ioctl creating the vtpm_proxy device
> pair and maps on a new chip flags TPM_CHIP_FLAG_NO_SYSFS.
No other subsystem does something so goofy, this really needs to be
part of namespace support for TPM.
Why can't you just make the sysfs files unreadable in user space?
If a container can make them readable again can't it also just create
the chardev node?
Jason
next prev parent reply other threads:[~2016-06-24 17:48 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-06-24 14:36 [PATCH] tpm: vtpm_proxy: Introduce flag to prevent sysfs entries Stefan Berger
2016-06-24 14:36 ` Stefan Berger
[not found] ` <1466779015-26965-1-git-send-email-stefanb-23VcF4HTsmIX0ybBhKVfKdBPR1lH4CV8@public.gmane.org>
2016-06-24 17:48 ` Jason Gunthorpe [this message]
2016-06-24 17:48 ` Jason Gunthorpe
[not found] ` <20160624174803.GA14506-ePGOBjL8dl3ta4EC/59zMFaTQe2KTcn/@public.gmane.org>
2016-06-24 18:43 ` Stefan Berger
2016-06-24 18:43 ` Stefan Berger
[not found] ` <576D7F34.50201-23VcF4HTsmIX0ybBhKVfKdBPR1lH4CV8@public.gmane.org>
2016-06-24 19:47 ` Jason Gunthorpe
2016-06-24 19:47 ` Jason Gunthorpe
2016-06-27 18:32 ` Jarkko Sakkinen
[not found] ` <20160627183220.GD7268-ral2JQCrhuEAvxtiuMwx3w@public.gmane.org>
2016-06-30 16:17 ` Stefan Berger
2016-06-30 16:17 ` Stefan Berger
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20160624174803.GA14506@obsidianresearch.com \
--to=jgunthorpe-epgobjl8dl3ta4ec/59zmfatqe2ktcn/@public.gmane.org \
--cc=linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org \
--cc=linux-security-module-u79uwXL29TY76Z2rM5mHXA@public.gmane.org \
--cc=stefanb-23VcF4HTsmIX0ybBhKVfKdBPR1lH4CV8@public.gmane.org \
--cc=tpmdd-devel-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.