Re: [tpmdd-devel] [PATCH] TPM: Fixup pubek sysfs file

[Jason Gunthorpe <jgunthorpe@obsidianresearch.com>]

On Mon, Sep 14, 2009 at 03:23:09PM -0400, Jonathan M. McCune wrote:

>> Can anyone think of a reason why the PCRs should be accessed from
>> sysfs? I can't. They are only really useful in connection with other
>> complex TPM operations. Userspace can fully access them using the
>> relevant TPM calls.
>
> Fair enough, though they are useful in combination with IMA and as a  
> sanity check that the driver is working correctly.
[..]
> IMA can leverage the ability to read and extend PCRs, and its security  
> properties derive from that functionality being a part of the kernel.  
> PCR reading is currently part of the TPM driver in 
> drivers/char/tpm/tpm.c.

Sanzzy

> Thus, to the question, "Can we remove the ability of the kernel to send  
> TPM commands such as GetCapability and PCRRead?" I believe the answer is  
> no. Or at least, not without causing a lot of work for the IMA system.  
> Although it may be worth discussing whether this functionality should be  
> moved from the driver into IMA.

Fair enough, fortunately TPM_PCRRead and TPM_Extend are two of the
simplest commands. As has been done special casing the fixed size
messages is easy and robust.

The pcrs file really isn't that offsensive to me, the PCR registers
can reasonably thought of as a single memory space. If it wasn't for
the PCR-%u prefix I think it would be fine for sysfs??

Ie:

BD ED 7B B2 EB AE BE 31 4E CC 57 82 81 64 FC 8A 09 FA 19 25 
05 37 25 B5 24 59 14 A5 94 1A 42 97 39 E6 07 40 27 3A 7D 48 
3A 3F 78 0F 11 A4 B4 99 69 FC AA 80 CD 6E 39 57 C3 3B 22 75 

not:

PCR-00: BD ED 7B B2 EB AE BE 31 4E CC 57 82 81 64 FC 8A 09 FA 19 25 
PCR-01: 05 37 25 B5 24 59 14 A5 94 1A 42 97 39 E6 07 40 27 3A 7D 48 
PCR-02: 3A 3F 78 0F 11 A4 B4 99 69 FC AA 80 CD 6E 39 57 C3 3B 22 75 

Greg?

Jason