From: Jarkko Sakkinen <jarkko@kernel.org>
To: Matthew Garrett <mjg59@srcf.ucam.org>
Cc: James Bottomley <James.Bottomley@hansenpartnership.com>,
Matthew Garrett <matthewg@nvidia.com>,
keyrings@vger.kernel.org, linux-integrity@vger.kernel.org,
rafael@kernel.org, linux-pm@vger.kernel.org,
linux-efi@vger.kernel.org
Subject: Re: [PATCH 01/17] tpm: Define a kernel-owned TPM NV index that can't be modified by userland
Date: Sun, 15 Nov 2026 17:15:35 +0200 [thread overview]
Message-ID: <avnMl7fD156F1fx4@kernel.org> (raw)
In-Reply-To: <asty4acE2B94t5q6@srcf.ucam.org>
On Sun, Oct 11, 2026 at 04:28:33AM -0700, Matthew Garrett wrote:
> On Sun, Oct 11, 2026 at 12:27:58PM +0200, James Bottomley wrote:
> > On Sun, 2026-10-11 at 03:23 -0700, Matthew Garrett wrote:
> > > Hmm. Well, that's irritating. Which year's XPS is this?
> >
> > It's an XPS-13 9380 Core i7 ... circa 2019 I think.
>
> Yes, that's definitely later than I hoped. Bother. I think this patchset
> is probably still worthwhile because it does unblock us on at least some
> machines, and the implementation is intended to be opaque (other than
> the change in PCR 5 measurements, but we should still get log replay)
> and can be replaced with something else if we want. The other approach
> that springs to mind is tying this to having distros switch to a new
> kernel signing key before enabling this and so having PCR 7 be
> associated with the feature, but that sounds like an incredibly tedious
> thing to get right in a reliable way.
What prevents blocking PCR 5 access from /dev/tpm*? If firmware already,
does it, this can only add defense-in-depth.
This feels way too obvious question to ask so I presume I'm missing
something.
Br, Jarkko
next prev parent reply other threads:[~2026-11-15 15:15 UTC|newest]
Thread overview: 58+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-08 13:20 [RFC] Make hibernation work with lockdown Matthew Garrett
2026-10-08 13:20 ` [PATCH 01/17] tpm: Define a kernel-owned TPM NV index that can't be modified by userland Matthew Garrett
2026-10-08 13:41 ` Matthew Garrett
2026-10-08 16:24 ` Jarkko Sakkinen
2026-10-08 16:23 ` Jarkko Sakkinen
2026-10-09 8:33 ` Matthew Garrett
2026-10-10 21:36 ` Jarkko Sakkinen
2026-10-08 17:06 ` Ilias Apalodimas
2026-10-10 9:22 ` James Bottomley
2026-10-10 21:26 ` Matthew Garrett
2026-10-11 6:04 ` James Bottomley
2026-10-11 10:23 ` Matthew Garrett
2026-10-11 10:27 ` James Bottomley
2026-10-11 11:28 ` Matthew Garrett
2026-11-15 15:15 ` Jarkko Sakkinen [this message]
2026-10-11 8:21 ` James Bottomley
2026-11-13 0:40 ` Jarkko Sakkinen
2026-11-13 0:45 ` Jarkko Sakkinen
2026-11-13 0:50 ` Jarkko Sakkinen
2026-10-08 13:20 ` [PATCH 02/17] efi: Add a mechanism to modify TPM state depending on kernel security features Matthew Garrett
2026-10-08 16:38 ` Jarkko Sakkinen
2026-10-08 13:20 ` [PATCH 03/17] tpm: Allow tpm2_start_auth_session() to start an audit session Matthew Garrett
2026-11-13 2:17 ` Jarkko Sakkinen
2026-10-08 13:20 ` [PATCH 04/17] tpm: Log commands executed in " Matthew Garrett
2026-10-08 13:20 ` [PATCH 05/17] tpm: Add a kernel attestation key and signed audit digest retrieval Matthew Garrett
2026-10-08 16:45 ` James Bottomley
2026-10-09 8:29 ` Matthew Garrett
2026-10-08 13:20 ` [PATCH 06/17] tpm: Use TPM2_NV_ReadPublic to read NV index names Matthew Garrett
2026-10-08 13:20 ` [PATCH 07/17] tpm: Add in-kernel support for reading NV indices Matthew Garrett
2026-10-08 13:20 ` [PATCH 08/17] tpm: Add NV define, undefine and write helpers Matthew Garrett
2026-10-08 13:20 ` [PATCH 09/17] tpm: Provision the kernel NV index at registration Matthew Garrett
2026-10-08 13:20 ` [PATCH 10/17] tpm: Move the bounds-checked response reader to a header Matthew Garrett
2026-10-08 13:20 ` [PATCH 11/17] tpm: Add kernel signing key creation with audited provenance Matthew Garrett
2026-10-08 17:00 ` James Bottomley
2026-10-09 8:31 ` Matthew Garrett
2026-10-08 13:20 ` [PATCH 12/17] tpm: Add signing with the kernel signing key Matthew Garrett
2026-10-08 13:20 ` [PATCH 13/17] tpm: Add verification of kernel signing key provenance Matthew Garrett
2026-10-10 9:34 ` James Bottomley
2026-10-10 21:18 ` Matthew Garrett
2026-10-10 9:42 ` James Bottomley
2026-10-10 21:20 ` Matthew Garrett
2026-11-13 2:25 ` Jarkko Sakkinen
2026-10-08 13:20 ` [PATCH 14/17] PM: hibernate: Add image digest and signature page infrastructure Matthew Garrett
2026-10-08 13:20 ` [PATCH 15/17] PM: hibernate: Sign and verify images with a kernel-generated TPM key Matthew Garrett
2026-10-08 13:20 ` [PATCH 16/17] PM: hibernate: Refuse to verify images with a virtual TPM Matthew Garrett
2026-10-08 13:20 ` [PATCH 17/17] PM: hibernate: Allow hibernation under lockdown with signed images Matthew Garrett
2026-10-08 16:53 ` Jarkko Sakkinen
2026-10-09 8:31 ` Matthew Garrett
2026-10-10 21:29 ` Jarkko Sakkinen
2026-10-08 15:56 ` [RFC] Make hibernation work with lockdown Jarkko Sakkinen
2026-10-23 15:28 ` Jarkko Sakkinen
2026-10-23 19:13 ` Jarkko Sakkinen
2026-10-31 3:01 ` Jarkko Sakkinen
2026-11-07 22:34 ` Neal Gompa
2026-11-10 1:36 ` Jarkko Sakkinen
2026-11-13 0:06 ` Jarkko Sakkinen
2026-11-15 15:02 ` Jarkko Sakkinen
2026-11-15 15:08 ` Jarkko Sakkinen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=avnMl7fD156F1fx4@kernel.org \
--to=jarkko@kernel.org \
--cc=James.Bottomley@hansenpartnership.com \
--cc=keyrings@vger.kernel.org \
--cc=linux-efi@vger.kernel.org \
--cc=linux-integrity@vger.kernel.org \
--cc=linux-pm@vger.kernel.org \
--cc=matthewg@nvidia.com \
--cc=mjg59@srcf.ucam.org \
--cc=rafael@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox