From: "Jarkko Sakkinen" <jarkko@kernel.org>
To: "Jarkko Sakkinen" <jarkko@kernel.org>,
"Ross Philipson" <ross.philipson@oracle.com>,
<linux-kernel@vger.kernel.org>, <x86@kernel.org>,
<linux-integrity@vger.kernel.org>, <linux-doc@vger.kernel.org>,
<linux-crypto@vger.kernel.org>, <kexec@lists.infradead.org>,
<linux-efi@vger.kernel.org>, <iommu@lists.linux-foundation.org>
Cc: <dpsmith@apertussolutions.com>, <tglx@linutronix.de>,
<mingo@redhat.com>, <bp@alien8.de>, <hpa@zytor.com>,
<dave.hansen@linux.intel.com>, <ardb@kernel.org>,
<mjg59@srcf.ucam.org>, <James.Bottomley@hansenpartnership.com>,
<peterhuewe@gmx.de>, <jgg@ziepe.ca>, <luto@amacapital.net>,
<nivedita@alum.mit.edu>, <herbert@gondor.apana.org.au>,
<davem@davemloft.net>, <corbet@lwn.net>, <ebiederm@xmission.com>,
<dwmw2@infradead.org>, <baolu.lu@linux.intel.com>,
<kanth.ghatraju@oracle.com>, <andrew.cooper3@citrix.com>,
<trenchboot-devel@googlegroups.com>
Subject: Re: [PATCH v11 18/20] tpm: Add sysfs interface to allow setting and querying the default locality
Date: Fri, 01 Nov 2024 23:50:05 +0200 [thread overview]
Message-ID: <D5B69X48SFO7.RMZ1I1926BPF@kernel.org> (raw)
In-Reply-To: <D5ARBBZU61YW.2SQ35HTOJ85F7@kernel.org>
On Fri Nov 1, 2024 at 12:06 PM EET, Jarkko Sakkinen wrote:
> On Fri Sep 13, 2024 at 11:05 PM EEST, Ross Philipson wrote:
> > Expose a sysfs interface to allow user mode to set and query the default
> > locality set for the TPM chip.
> >
> > Signed-off-by: Ross Philipson <ross.philipson@oracle.com>
>
> Must be read-only. Should be decided per power cycle.
I'm throwing one incomplete idea not all things considered...
So one idea is would be to apply set operation to /dev/tpm0 as ioctl
(would not be available for /dev/tpmrm0).
Then at least access control rules would apply.
The open here is that the IMA etc. will use a different locality during
boot-time, like it would also with sysfs attribute.
BR, Jarkko
_______________________________________________
kexec mailing list
kexec@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/kexec
WARNING: multiple messages have this Message-ID (diff)
From: "Jarkko Sakkinen" <jarkko@kernel.org>
To: "Jarkko Sakkinen" <jarkko@kernel.org>,
"Ross Philipson" <ross.philipson@oracle.com>,
<linux-kernel@vger.kernel.org>, <x86@kernel.org>,
<linux-integrity@vger.kernel.org>, <linux-doc@vger.kernel.org>,
<linux-crypto@vger.kernel.org>, <kexec@lists.infradead.org>,
<linux-efi@vger.kernel.org>, <iommu@lists.linux-foundation.org>
Cc: <dpsmith@apertussolutions.com>, <tglx@linutronix.de>,
<mingo@redhat.com>, <bp@alien8.de>, <hpa@zytor.com>,
<dave.hansen@linux.intel.com>, <ardb@kernel.org>,
<mjg59@srcf.ucam.org>, <James.Bottomley@hansenpartnership.com>,
<peterhuewe@gmx.de>, <jgg@ziepe.ca>, <luto@amacapital.net>,
<nivedita@alum.mit.edu>, <herbert@gondor.apana.org.au>,
<davem@davemloft.net>, <corbet@lwn.net>, <ebiederm@xmission.com>,
<dwmw2@infradead.org>, <baolu.lu@linux.intel.com>,
<kanth.ghatraju@oracle.com>, <andrew.cooper3@citrix.com>,
<trenchboot-devel@googlegroups.com>
Subject: Re: [PATCH v11 18/20] tpm: Add sysfs interface to allow setting and querying the default locality
Date: Fri, 01 Nov 2024 23:50:05 +0200 [thread overview]
Message-ID: <D5B69X48SFO7.RMZ1I1926BPF@kernel.org> (raw)
In-Reply-To: <D5ARBBZU61YW.2SQ35HTOJ85F7@kernel.org>
On Fri Nov 1, 2024 at 12:06 PM EET, Jarkko Sakkinen wrote:
> On Fri Sep 13, 2024 at 11:05 PM EEST, Ross Philipson wrote:
> > Expose a sysfs interface to allow user mode to set and query the default
> > locality set for the TPM chip.
> >
> > Signed-off-by: Ross Philipson <ross.philipson@oracle.com>
>
> Must be read-only. Should be decided per power cycle.
I'm throwing one incomplete idea not all things considered...
So one idea is would be to apply set operation to /dev/tpm0 as ioctl
(would not be available for /dev/tpmrm0).
Then at least access control rules would apply.
The open here is that the IMA etc. will use a different locality during
boot-time, like it would also with sysfs attribute.
BR, Jarkko
next prev parent reply other threads:[~2024-11-01 21:50 UTC|newest]
Thread overview: 116+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-09-13 20:04 [PATCH v11 00/20] x86: Trenchboot secure dynamic launch Linux kernel support Ross Philipson
2024-09-13 20:04 ` Ross Philipson
2024-09-13 20:04 ` [PATCH v11 01/20] Documentation/x86: Secure Launch kernel documentation Ross Philipson
2024-09-13 20:04 ` Ross Philipson
2024-11-01 19:31 ` Elliott, Robert (Servers)
2024-11-01 19:31 ` Elliott, Robert (Servers)
2024-09-13 20:04 ` [PATCH v11 02/20] x86: Secure Launch Kconfig Ross Philipson
2024-09-13 20:04 ` Ross Philipson
2024-09-13 20:05 ` [PATCH v11 03/20] x86: Secure Launch Resource Table header file Ross Philipson
2024-09-13 20:05 ` Ross Philipson
2024-09-13 20:05 ` [PATCH v11 04/20] x86: Secure Launch main " Ross Philipson
2024-09-13 20:05 ` Ross Philipson
2024-09-13 20:05 ` [PATCH v11 05/20] x86: Add early SHA-1 support for Secure Launch early measurements Ross Philipson
2024-09-13 20:05 ` Ross Philipson
2024-09-13 20:05 ` [PATCH v11 06/20] x86: Add early SHA-256 " Ross Philipson
2024-09-13 20:05 ` Ross Philipson
2024-09-13 20:05 ` [PATCH v11 07/20] x86/msr: Add variable MTRR base/mask and x2apic ID registers Ross Philipson
2024-09-13 20:05 ` Ross Philipson
2024-09-13 20:05 ` [PATCH v11 08/20] x86/boot: Place TXT MLE header in the kernel_info section Ross Philipson
2024-09-13 20:05 ` Ross Philipson
2024-09-13 20:05 ` [PATCH v11 09/20] x86: Secure Launch kernel early boot stub Ross Philipson
2024-09-13 20:05 ` Ross Philipson
2024-09-13 20:05 ` [PATCH v11 10/20] x86: Secure Launch kernel late " Ross Philipson
2024-09-13 20:05 ` Ross Philipson
2024-09-13 20:05 ` [PATCH v11 11/20] x86: Secure Launch SMP bringup support Ross Philipson
2024-09-13 20:05 ` Ross Philipson
2024-09-13 20:05 ` [PATCH v11 12/20] kexec: Secure Launch kexec SEXIT support Ross Philipson
2024-09-13 20:05 ` Ross Philipson
2024-09-13 20:05 ` [PATCH v11 13/20] x86/reboot: Secure Launch SEXIT support on reboot paths Ross Philipson
2024-09-13 20:05 ` Ross Philipson
2024-09-13 20:05 ` [PATCH v11 14/20] tpm: Protect against locality counter underflow Ross Philipson
2024-09-13 20:05 ` Ross Philipson
2024-11-01 9:33 ` Jarkko Sakkinen
2024-11-01 9:33 ` Jarkko Sakkinen
2024-09-13 20:05 ` [PATCH v11 15/20] tpm: Ensure tpm is in known state at startup Ross Philipson
2024-09-13 20:05 ` Ross Philipson
2024-11-01 9:37 ` Jarkko Sakkinen
2024-11-01 9:37 ` Jarkko Sakkinen
2024-11-02 14:02 ` Jarkko Sakkinen
2024-11-02 14:02 ` Jarkko Sakkinen
2024-09-13 20:05 ` [PATCH v11 16/20] tpm: Make locality requests return consistent values Ross Philipson
2024-09-13 20:05 ` Ross Philipson
2024-11-01 10:04 ` Jarkko Sakkinen
2024-11-01 10:04 ` Jarkko Sakkinen
2024-11-02 14:26 ` Jarkko Sakkinen
2024-11-02 14:26 ` Jarkko Sakkinen
2024-09-13 20:05 ` [PATCH v11 17/20] tpm: Add ability to set the default locality the TPM chip uses Ross Philipson
2024-09-13 20:05 ` Ross Philipson
2024-11-01 10:05 ` Jarkko Sakkinen
2024-11-01 10:05 ` Jarkko Sakkinen
2024-11-02 1:37 ` [RFC PATCH] tpm, tpm_tis: Introduce TPM_IOC_SET_LOCALITY Jarkko Sakkinen
2024-11-02 1:37 ` Jarkko Sakkinen
2024-11-02 1:39 ` Jarkko Sakkinen
2024-11-02 1:39 ` Jarkko Sakkinen
2024-11-02 6:22 ` [RFC PATCH v2 1/2] " Jarkko Sakkinen
2024-11-02 6:22 ` Jarkko Sakkinen
2024-11-02 6:22 ` [RFC PATCH v2 2/2] tpm: show the default locality in sysfs Jarkko Sakkinen
2024-11-02 6:22 ` Jarkko Sakkinen
2024-11-02 6:29 ` [RFC PATCH v2 1/2] tpm, tpm_tis: Introduce TPM_IOC_SET_LOCALITY Jarkko Sakkinen
2024-11-02 6:29 ` Jarkko Sakkinen
2024-11-02 9:02 ` Ard Biesheuvel
2024-11-02 9:02 ` Ard Biesheuvel
2024-11-02 10:38 ` Jarkko Sakkinen
2024-11-02 10:38 ` Jarkko Sakkinen
2024-11-02 10:40 ` Jarkko Sakkinen
2024-11-02 10:40 ` Jarkko Sakkinen
2024-11-02 10:52 ` Ard Biesheuvel
2024-11-02 10:52 ` Ard Biesheuvel
2024-11-02 13:39 ` Jarkko Sakkinen
2024-11-02 13:39 ` Jarkko Sakkinen
2024-11-02 14:07 ` Jarkko Sakkinen
2024-11-02 14:07 ` Jarkko Sakkinen
2024-09-13 20:05 ` [PATCH v11 18/20] tpm: Add sysfs interface to allow setting and querying the default locality Ross Philipson
2024-09-13 20:05 ` Ross Philipson
2024-11-01 3:17 ` James Bottomley
2024-11-01 3:17 ` James Bottomley
2024-11-01 10:06 ` Jarkko Sakkinen
2024-11-01 10:06 ` Jarkko Sakkinen
2024-11-01 21:50 ` Jarkko Sakkinen [this message]
2024-11-01 21:50 ` Jarkko Sakkinen
2024-11-01 21:56 ` Jarkko Sakkinen
2024-11-01 21:56 ` Jarkko Sakkinen
2024-09-13 20:05 ` [PATCH v11 19/20] x86: Secure Launch late initcall platform module Ross Philipson
2024-09-13 20:05 ` Ross Philipson
2024-09-13 20:05 ` [PATCH v11 20/20] x86/efi: EFI stub DRTM launch support for Secure Launch Ross Philipson
2024-09-13 20:05 ` Ross Philipson
2024-10-31 19:25 ` [PATCH v11 00/20] x86: Trenchboot secure dynamic launch Linux kernel support Thomas Gleixner
2024-10-31 19:25 ` Thomas Gleixner
2024-10-31 22:37 ` Jarkko Sakkinen
2024-10-31 22:37 ` Jarkko Sakkinen
2024-10-31 23:08 ` Thomas Gleixner
2024-10-31 23:08 ` Thomas Gleixner
2024-11-01 0:33 ` Jarkko Sakkinen
2024-11-01 0:33 ` Jarkko Sakkinen
2024-11-01 0:40 ` Jarkko Sakkinen
2024-11-01 0:40 ` Jarkko Sakkinen
2024-11-01 8:50 ` Ard Biesheuvel
2024-11-01 8:50 ` Ard Biesheuvel
2024-11-01 9:18 ` Jarkko Sakkinen
2024-11-01 9:18 ` Jarkko Sakkinen
2024-11-01 9:30 ` Jarkko Sakkinen
2024-11-01 9:30 ` Jarkko Sakkinen
2024-11-01 14:51 ` Jarkko Sakkinen
2024-11-01 14:51 ` Jarkko Sakkinen
2024-11-01 10:28 ` Jarkko Sakkinen
2024-11-01 10:28 ` Jarkko Sakkinen
2024-11-01 20:34 ` Thomas Gleixner
2024-11-01 20:34 ` Thomas Gleixner
2024-11-01 21:13 ` Jarkko Sakkinen
2024-11-01 21:13 ` Jarkko Sakkinen
2024-11-01 21:19 ` Jarkko Sakkinen
2024-11-01 21:19 ` Jarkko Sakkinen
2024-11-01 22:04 ` Thomas Gleixner
2024-11-01 22:04 ` Thomas Gleixner
2024-11-01 22:18 ` Jarkko Sakkinen
2024-11-01 22:18 ` Jarkko Sakkinen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=D5B69X48SFO7.RMZ1I1926BPF@kernel.org \
--to=jarkko@kernel.org \
--cc=James.Bottomley@hansenpartnership.com \
--cc=andrew.cooper3@citrix.com \
--cc=ardb@kernel.org \
--cc=baolu.lu@linux.intel.com \
--cc=bp@alien8.de \
--cc=corbet@lwn.net \
--cc=dave.hansen@linux.intel.com \
--cc=davem@davemloft.net \
--cc=dpsmith@apertussolutions.com \
--cc=dwmw2@infradead.org \
--cc=ebiederm@xmission.com \
--cc=herbert@gondor.apana.org.au \
--cc=hpa@zytor.com \
--cc=iommu@lists.linux-foundation.org \
--cc=jgg@ziepe.ca \
--cc=kanth.ghatraju@oracle.com \
--cc=kexec@lists.infradead.org \
--cc=linux-crypto@vger.kernel.org \
--cc=linux-doc@vger.kernel.org \
--cc=linux-efi@vger.kernel.org \
--cc=linux-integrity@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=luto@amacapital.net \
--cc=mingo@redhat.com \
--cc=mjg59@srcf.ucam.org \
--cc=nivedita@alum.mit.edu \
--cc=peterhuewe@gmx.de \
--cc=ross.philipson@oracle.com \
--cc=tglx@linutronix.de \
--cc=trenchboot-devel@googlegroups.com \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.