From mboxrd@z Thu Jan 1 00:00:00 1970 From: Jarkko Sakkinen Subject: Re: [RFC PATCH 3/4] Implement driver for supporting multiple emulated TPMs Date: Tue, 26 Jan 2016 18:50:57 -0800 Message-ID: <20160127025057.GB23863@intel.com> References: <1452787318-29610-1-git-send-email-stefanb@us.ibm.com> <1452787318-29610-4-git-send-email-stefanb@us.ibm.com> <20160119235107.GA4307@obsidianresearch.com> <201601201439.u0KEdFao027907@d03av05.boulder.ibm.com> <20160121011701.GA20361@obsidianresearch.com> <201601210301.u0L31hLD018933@d03av02.boulder.ibm.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Content-Disposition: inline In-Reply-To: <201601210301.u0L31hLD018933-nNA/7dmquNI+UXBhvPuGgqsjOiXwFzmk@public.gmane.org> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: tpmdd-devel-bounces-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org To: Stefan Berger Cc: dhowells-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org, tpmdd-devel-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org, dwmw2-wEGCiKHe2LqWVfeAwA7xHQ@public.gmane.org List-Id: tpmdd-devel@lists.sourceforge.net On Wed, Jan 20, 2016 at 10:01:38PM -0500, Stefan Berger wrote: > > Except that isn't good enough - the IMA kernel side doesn't know that this > > tpm is now acting as the 'main' 'default' TPM. > > Hooking the vTPM to IMA requires another patch that I haven't shown since IMA > namespacing isn't public yet. Basically we implement another ioctl() that is to > be called before the clone() in order to 'reserve' a vtpm device pair for the > calling process. During the clone() call IMA namespacing code can query the > vTPM driver for a 'reserved' device pair. Hooking IMA up after the clone() may > also work but in case of docker/golang it's better to do this before since the > language libraries do a lot after the clone automatically. Can we expect that "in the end" there will be a single patch set that contains both TPM and IMA changes? Otherwise, I see it very hard to make decision to apply TPM patches. /Jarkko ------------------------------------------------------------------------------ Site24x7 APM Insight: Get Deep Visibility into Application Performance APM + Mobile APM + RUM: Monitor 3 App instances at just $35/Month Monitor end-to-end web transactions and take corrective actions now Troubleshoot faster and improve end-user experience. Signup Now! http://pubads.g.doubleclick.net/gampad/clk?id=267308311&iu=/4140