From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mga01.intel.com ([192.55.52.88]:23450 "EHLO mga01.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755541AbeEJBnG (ORCPT ); Wed, 9 May 2018 21:43:06 -0400 Date: Thu, 10 May 2018 04:42:59 +0300 From: Jarkko Sakkinen To: James Bottomley Cc: "David R. Bild" , philip.b.tricca@intel.com, Jason Gunthorpe , Greg Kroah-Hartman , Peter Huewe , linux-usb@vger.kernel.org, linux-integrity@vger.kernel.org Subject: Re: [PATCH v3 2/2] usb: misc: xapea00x: perform platform initialization of TPM Message-ID: <20180510014259.GL6190@linux.intel.com> References: <20180430125418.31344-1-david.bild@xaptum.com> <20180504130022.5231-3-david.bild@xaptum.com> <20180504190638.ikqhdvcqccakzdjd@ziepe.ca> <20180508105515.GB6132@linux.intel.com> <1525793148.3672.8.camel@HansenPartnership.com> MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 In-Reply-To: <1525793148.3672.8.camel@HansenPartnership.com> Sender: linux-integrity-owner@vger.kernel.org List-ID: On Tue, May 08, 2018 at 08:25:48AM -0700, James Bottomley wrote: > On Tue, 2018-05-08 at 13:55 +0300, Jarkko Sakkinen wrote: > > On Fri, May 04, 2018 at 02:56:25PM -0500, David R. Bild wrote: > [...] > > > In particular, it sets the credentials for the platform hierarchy. > > > The platform hierarchy is essentially the "root" account of the > > > TPM, so it's critical that those credentials be set before the TPM > > > is exposed to user-space. (The platform credentials aren't > > > persisted in the TPM and must be set by the platform on every > > > boot.) If the driver registers the TPM before doing > > > initialization, there's a chance that something else could access > > > the TPM before the platform credentials get set. > > > > Maybe. Not sure yet where to draw the line eg should TSS2 daemon to > > do it for example. > > > > James? Philip? > > I don't see any reason to set an unreachable password for the platform > hierarchy if the UEFI didn't. If the desire is to disable the platform > hierarchy, then it should be disabled, not have a random password set. > I'd also say this is probably the job of early boot based on policy. > > James A valid point. /Jarkko From mboxrd@z Thu Jan 1 00:00:00 1970 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 Subject: [v3,2/2] usb: misc: xapea00x: perform platform initialization of TPM From: Jarkko Sakkinen Message-Id: <20180510014259.GL6190@linux.intel.com> Date: Thu, 10 May 2018 04:42:59 +0300 To: James Bottomley Cc: "David R. Bild" , philip.b.tricca@intel.com, Jason Gunthorpe , Greg Kroah-Hartman , Peter Huewe , linux-usb@vger.kernel.org, linux-integrity@vger.kernel.org List-ID: T24gVHVlLCBNYXkgMDgsIDIwMTggYXQgMDg6MjU6NDhBTSAtMDcwMCwgSmFtZXMgQm90dG9tbGV5 IHdyb3RlOgo+IE9uIFR1ZSwgMjAxOC0wNS0wOCBhdCAxMzo1NSArMDMwMCwgSmFya2tvIFNha2tp bmVuIHdyb3RlOgo+ID4gT24gRnJpLCBNYXkgMDQsIDIwMTggYXQgMDI6NTY6MjVQTSAtMDUwMCwg RGF2aWQgUi4gQmlsZCB3cm90ZToKPiBbLi4uXQo+ID4gPiBJbiBwYXJ0aWN1bGFyLCBpdCBzZXRz IHRoZSBjcmVkZW50aWFscyBmb3IgdGhlIHBsYXRmb3JtIGhpZXJhcmNoeS4KPiA+ID4gVGhlIHBs YXRmb3JtIGhpZXJhcmNoeSBpcyBlc3NlbnRpYWxseSB0aGUgInJvb3QiIGFjY291bnQgb2YgdGhl Cj4gPiA+IFRQTSwgc28gaXQncyBjcml0aWNhbCB0aGF0IHRob3NlIGNyZWRlbnRpYWxzIGJlIHNl dCBiZWZvcmUgdGhlIFRQTQo+ID4gPiBpcyBleHBvc2VkIHRvIHVzZXItc3BhY2UuwqDCoChUaGUg cGxhdGZvcm0gY3JlZGVudGlhbHMgYXJlbid0Cj4gPiA+IHBlcnNpc3RlZCBpbiB0aGUgVFBNIGFu ZCBtdXN0IGJlIHNldCBieSB0aGUgcGxhdGZvcm0gb24gZXZlcnkKPiA+ID4gYm9vdC4pwqDCoElm IHRoZSBkcml2ZXIgcmVnaXN0ZXJzIHRoZSBUUE0gYmVmb3JlIGRvaW5nCj4gPiA+IGluaXRpYWxp emF0aW9uLCB0aGVyZSdzIGEgY2hhbmNlIHRoYXQgc29tZXRoaW5nIGVsc2UgY291bGQgYWNjZXNz Cj4gPiA+IHRoZSBUUE0gYmVmb3JlIHRoZSBwbGF0Zm9ybSBjcmVkZW50aWFscyBnZXQgc2V0Lgo+ ID4gCj4gPiBNYXliZS4gTm90IHN1cmUgeWV0IHdoZXJlIHRvIGRyYXcgdGhlIGxpbmUgZWcgc2hv dWxkIFRTUzIgZGFlbW9uIHRvCj4gPiBkbyBpdCBmb3IgZXhhbXBsZS4KPiA+IAo+ID4gSmFtZXM/ IFBoaWxpcD8KPiAKPiBJIGRvbid0IHNlZSBhbnkgcmVhc29uIHRvIHNldCBhbiB1bnJlYWNoYWJs ZSBwYXNzd29yZCBmb3IgdGhlIHBsYXRmb3JtCj4gaGllcmFyY2h5IGlmIHRoZSBVRUZJIGRpZG4n dC4gIElmIHRoZSBkZXNpcmUgaXMgdG8gZGlzYWJsZSB0aGUgcGxhdGZvcm0KPiBoaWVyYXJjaHks IHRoZW4gaXQgc2hvdWxkIGJlIGRpc2FibGVkLCBub3QgaGF2ZSBhIHJhbmRvbSBwYXNzd29yZCBz ZXQuIAo+IEknZCBhbHNvIHNheSB0aGlzIGlzIHByb2JhYmx5IHRoZSBqb2Igb2YgZWFybHkgYm9v dCBiYXNlZCBvbiBwb2xpY3kuCj4gCj4gSmFtZXMKCkEgdmFsaWQgcG9pbnQuCgovSmFya2tvCi0t LQpUbyB1bnN1YnNjcmliZSBmcm9tIHRoaXMgbGlzdDogc2VuZCB0aGUgbGluZSAidW5zdWJzY3Jp YmUgbGludXgtdXNiIiBpbgp0aGUgYm9keSBvZiBhIG1lc3NhZ2UgdG8gbWFqb3Jkb21vQHZnZXIu a2VybmVsLm9yZwpNb3JlIG1ham9yZG9tbyBpbmZvIGF0ICBodHRwOi8vdmdlci5rZXJuZWwub3Jn L21ham9yZG9tby1pbmZvLmh0bWwK