[meta-security][PATCH resend] Parsec-service: add parsec user to teeclnt group when optee is present

[meta-security][PATCH resend] Parsec-service: add parsec user to teeclnt group when optee is present

[Jerome Forissier]

The optee-client package provides a PKCS#11 interface that may be used by
Parsec with the below configuration. For this to work, the parsec user
needs to be a member of the teeclnt group. Therefore, add it when 'optee'
is present in MACHINE_FEATURES.

 # Provider configuration in /etc/parsec/config.toml
 [[provider]]
 name = "pkcs11-optee"
 provider_type = "Pkcs11"
 key_info_manager = "sqlite-manager"
 library_path = "/usr/lib/libckteec.so.0"

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
---
 .../recipes-parsec/parsec-service/parsec-service_1.0.0.bb        | 1 +
 1 file changed, 1 insertion(+)

This is a resend because a few hours after my initial post I still can't
find it at https://lists.yoctoproject.org/g/yocto/messages. I am now
subscribed to the list so hopefully it will help (although
https://git.yoctoproject.org/meta-security/tree/README doesn't mention
subscription).

diff --git a/meta-parsec/recipes-parsec/parsec-service/parsec-service_1.0.0.bb b/meta-parsec/recipes-parsec/parsec-service/parsec-service_1.0.0.bb
index ad7e560..ea2b0c9 100644
--- a/meta-parsec/recipes-parsec/parsec-service/parsec-service_1.0.0.bb
+++ b/meta-parsec/recipes-parsec/parsec-service/parsec-service_1.0.0.bb
@@ -68,6 +68,7 @@ USERADD_PACKAGES = "${PN}"
 USERADD_PARAM:${PN} = "-r -g parsec -s /bin/false -d ${localstatedir}/lib/parsec parsec"
 GROUPADD_PARAM:${PN} = "-r parsec"
 GROUPMEMS_PARAM:${PN} = "${@bb.utils.contains('PACKAGECONFIG_CONFARGS', 'tpm-provider', '-a parsec -g tss', '', d)}"
+GROUPMEMS_PARAM:${PN} = "${@bb.utils.contains('MACHINE_FEATURES', 'optee', '-a parsec -g teeclnt', '', d)}"
 
 FILES:${PN} += " \
     ${sysconfdir}/parsec/config.toml \
-- 
2.34.1

Re: [meta-security][PATCH resend] Parsec-service: add parsec user to teeclnt group when optee is present

[Anton Antonov]

[-- Attachment #1: Type: text/plain, Size: 456 bytes --]

The latest version of parsec-service recipe adds parsec into teeclnt group if Parsec is built with TS provider:

https://git.yoctoproject.org/meta-security/tree/meta-parsec/recipes-parsec/parsec-service/parsec-service_1.0.0.bb#n75

In this case teeclnt group is created by libts recipe (it will be merged into meat-arm later this week).

With your change it's not clear what recipe will create the group. Could you point me to this recipe.

Anton

[-- Attachment #2: Type: text/html, Size: 655 bytes --]

Re: [meta-security][PATCH resend] Parsec-service: add parsec user to teeclnt group when optee is present

[Anton Antonov]

[-- Attachment #1: Type: text/plain, Size: 557 bytes --]

Hi Jerome,

Parsec doesn't depend on optee-client and doesn't require it at all. If Parsec is built with the Trusted Services provider included  then `libts` is added into DEPENDS and RDEPENDS:

https://git.yoctoproject.org/meta-security/tree/meta-parsec/recipes-parsec/parsec-service/parsec-service_1.0.0.bb#n23

The libts recipe (it will be merged into meta-arm later today or tomorrow together with other generic recipes for Trusted Services Secure Partitions (SWd side) and test/demo tools (NWd side)) creates `teeclnt` group.

Cheers,
Anton

[-- Attachment #2: Type: text/html, Size: 765 bytes --]