[tpm2] get TPM applications to happily co-exist

[Ted Kim <ted.h.kim at oracle.com>]

[-- Attachment #1: Type: text/plain, Size: 1023 bytes --]

Folks,

The question has come up about how to get TPM applications to happily 
coexist with minimal coordination.

One issue in the owner hierarchy is we want each application to to be 
able to manage it's own objects but not affect those of the other 
applications.

So for example, we only want application A to be able to evict 
persistent handles owned by that application and not those of another 
application B.

If I understand, tpm2_evictcontrol command, the authorization is on the 
hierarchy and not on the object. Maybe I am thinking about this wrong, 
but is there a way in the authorization to look at some property of the 
object and tell who "owns" it and then figure out if this should be 
allowed or not ?

Otherwise, I think, we end up building some other software which knows 
how to authorize this on the hierarchy and keeps track of who owns what 
and then issues the eviction only when the owner of an object is the 
requester.

Am open to any suggestions.

Thanks,
-ted