From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752305AbdJPLrG (ORCPT ); Mon, 16 Oct 2017 07:47:06 -0400 Received: from mga03.intel.com ([134.134.136.65]:51006 "EHLO mga03.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752346AbdJPLrF (ORCPT ); Mon, 16 Oct 2017 07:47:05 -0400 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.43,371,1503385200"; d="scan'208";a="669989" Date: Mon, 16 Oct 2017 14:47:02 +0300 From: Jarkko Sakkinen To: Boshi Wang Cc: linux-integrity@vger.kernel.org, linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH] keys, trusted: fix missing support for TPM 2.0 in trusted_update() Message-ID: <20171016114702.axfsnfxdrleofibu@linux.intel.com> References: <683216c3-d61a-1b24-c38c-b3f4348ce876@huawei.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <683216c3-d61a-1b24-c38c-b3f4348ce876@huawei.com> Organization: Intel Finland Oy - BIC 0357606-4 - Westendinkatu 7, 02160 Espoo User-Agent: NeoMutt/20170609 (1.8.3) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Mon, Oct 16, 2017 at 10:53:13AM +0800, Boshi Wang wrote: > Call tpm_seal_trusted() in trusted_update() for TPM 2.0 chips. > > Signed-off-by: Boshi Wang > --- > security/keys/trusted.c | 10 +++++++++- > 1 file changed, 9 insertions(+), 1 deletion(-) > > diff --git a/security/keys/trusted.c b/security/keys/trusted.c > index ddfaebf..563fe5f 100644 > --- a/security/keys/trusted.c > +++ b/security/keys/trusted.c > @@ -1065,6 +1065,11 @@ static int trusted_update(struct key *key, struct key_preparsed_payload *prep) > size_t datalen = prep->datalen; > char *datablob; > int ret = 0; > + int tpm2; > + > + tpm2 = tpm_is_tpm2(TPM_ANY_NUM); > + if (tpm2 < 0) > + return tpm2; > > if (test_bit(KEY_FLAG_NEGATIVE, &key->flags)) > return -ENOKEY; > @@ -1110,7 +1115,10 @@ static int trusted_update(struct key *key, struct key_preparsed_payload *prep) > dump_payload(p); > dump_payload(new_p); > > - ret = key_seal(new_p, new_o); > + if (tpm2) > + ret = tpm_seal_trusted(TPM_ANY_NUM, new_p, new_o); > + else > + ret = key_seal(new_p, new_o); > if (ret < 0) { > pr_info("trusted_key: key_seal failed (%d)\n", ret); > kzfree(new_p); > -- > 2.10.1 > > > Reviewed-by: Jarkko Sakkinen The sealing code for TPM 1.2 should be moved to driver/char/tpm (has been in my backlog for couple of years now). /Jarkko