Re: [RFC PATCH 3/4] Implement driver for supporting multiple emulated TPMs

["Stefan Berger" <stefanb-r/Jw6+rmf7HQT0dZR+AlfA@public.gmane.org>]

[-- Attachment #1.1: Type: text/plain, Size: 4099 bytes --]

Jason Gunthorpe <jgunthorpe-ePGOBjL8dl3ta4EC/59zMFaTQe2KTcn/@public.gmane.org> wrote on 01/21/2016 
12:42:43 PM:

> 
> On Wed, Jan 20, 2016 at 10:56:21PM -0500, Stefan Berger wrote:
> > The IMA namespace is created as part of clone(). You cannot pass 
> anything via
> > clone(). So you either have to do it before or immediately after. 
> If after is
> > too later for whatever reason, you have to do it before.
> 
> Follow the pattern of something like the net ns.
> 
> clone creates an 'empty' IMA namespace. After clone the child waits
> for the parent to complete its work.
> 
> The parent creates a new vtpm /dev/tpm1 in it's namespace
> 
> The parent does a kernel call to make tpm1 visiable in the child's
> IMA namespace as tpm0. (eg look at the 'ip link set .. netns ..' kind
> of scheme for inspiration)

What is IMA namespace in relation to a device's name? The method is to 
read the major/minor numbers on the host and created /dev/tpm0 with the 
same major/minor numbers in the container's filesystem. The name doesn't 
matter I guess, but major/minor are important.

> 
> Hook the tpm core's id to struct tpm_chip code into the IMA namespace
> so that /dev/tpm0 and all other places actually access tpm1 when used
> in the child's IMA namespace
> 
> The parent signals the child to continue to run. The child has a
> /dev/tpm0 that is actually routed to /dev/tpm1. The child is prevented
> from accessing other tpms.


The problem I have run into in particular with Docker and golang is that 
Docker invokes the golang function to run an external program. The golang 
function does a clone(), a whole lot of other stuff after it, and in the 
end the execve().

The code is here:

https://golang.org/src/syscall/exec_linux.go

Look at the function forkAndExecInChild on line 56++.

The problem with that is that the execve() will trigger IMA measurements. 
IMA will refuse being hooked up with a vTPM driver if it couldn't put its 
first measurement(s) into a vTPM. I don't think we should queue PCR 
extensions until a device may eventually become available. So, the 
conclusion is, to accomodate golang (for example) we can create the device 
pair, sit the vTPM on top of the master, and reserve the device pair befor 
the next clone() so that IMA finds it and can hook up to it. 

What is wrong with this scheme? The ioctl for 'reservation' before the 
clone()?


> 
> 
> > > Then just return the fd like I said.
> > 
> > Any driver that can be used as an example ?
> 
> The stuff in include/linux/anon_inodes.h is used to do this, eg
> a sequence of anon_inode_getfile, get_unused_fd_flags, fd_install
> will create a file descriptor in the calling process associated with a
> struct file_operations
> 

So let me show how things work currently.

fd = open("/dev/vtpmx", ...);
ioctl(fd, 'create device pair; TPM will be a TPM 2 version device')
/* conveying that the device is a TPM 2 or 1.2 is important so that the 
kernel sends the right commands to the device and possibly also for sysfs 
handling */

/* at this point /dev/vtpmc0 and /dev/vtpms0 have been created */
clientfd = open("/dev/vtpmc0",...)
serverfd = open("/dev/vtpms0",...);

...

close(serverfd); /* /dev/vtpmc0 and /dev/vtpms0 disappeared */




Should it work like this?

serverfd = open("/dev/vtpmx", ...);
/* at this point /dev/vtpmc0 has been created and serverfd is used for the 
server side */

ioctl(fd, 'TPM will be a TPM 2 version device') /* setting flags on the 
chip->flags 'late' should be possible */

...

close(serverfd); /* /dev/vtpmc0 disappeared */


Regards,
   Stefan


> > > auto-delete a master char dev on close is a very strange API, don't 
do
> > > that.
> > 
> > What I called cleanup can be trigger by the vTPM closing /dev/
> vtpms%d, so the
> > server-side. What is the master for you? /dev/vtpmx where we run 
> the ioctls on?
> 
> Sorry, master/slave is the ptx nomenclature for this scheme. Master
> would be your server side I think. 
> 
> Jason
> 



[-- Attachment #1.2: Type: text/html, Size: 5484 bytes --]

[-- Attachment #2: Type: text/plain, Size: 413 bytes --]

------------------------------------------------------------------------------
Site24x7 APM Insight: Get Deep Visibility into Application Performance
APM + Mobile APM + RUM: Monitor 3 App instances at just $35/Month
Monitor end-to-end web transactions and take corrective actions now
Troubleshoot faster and improve end-user experience. Signup Now!
http://pubads.g.doubleclick.net/gampad/clk?id=267308311&iu=/4140

[-- Attachment #3: Type: text/plain, Size: 192 bytes --]

_______________________________________________
tpmdd-devel mailing list
tpmdd-devel-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org
https://lists.sourceforge.net/lists/listinfo/tpmdd-devel