Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
User-Agent: K-9 Mail for Android
In-Reply-To: <bb256d5a-5c8c-d5ec-5ad2-ddfaf1c83217@intel.com>
References: <157617292787.8172.9586296287013438621.stgit@tstruk-mobl1> <157617293957.8172.1404790695313599409.stgit@tstruk-mobl1> <1576180263.10287.4.camel@HansenPartnership.com> <c3bffb8c-d454-1f53-7f7e-8b65884ffaf6@intel.com> <1576184085.10287.13.camel@HansenPartnership.com> <bb256d5a-5c8c-d5ec-5ad2-ddfaf1c83217@intel.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Content-Type: text/plain;
 charset=UTF-8
Subject: Re: [PATCH =v2 3/3] tpm: selftest: cleanup after unseal with wrong auth/policy test
From:   James Bottomley <James.Bottomley@Hansenpartnership.com>
Date:   Thu, 12 Dec 2019 16:11:42 -0500
To:     Tadeusz Struk <tadeusz.struk@intel.com>,
        jarkko.sakkinen@linux.intel.com
CC:     peterz@infradead.org, linux-kernel@vger.kernel.org, jgg@ziepe.ca,
        mingo@redhat.com, jeffrin@rajagiritech.edu.in,
        linux-integrity@vger.kernel.org, will@kernel.org, peterhuewe@gmx.de
Message-ID: <0cfd1aa8-b4d4-4903-a7cc-70191ca842f4@email.android.com>
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On December 12, 2019 4:07:26 PM EST, Tadeusz Struk <tadeusz.struk@intel.com> wrote:
>On 12/12/19 12:54 PM, James Bottomley wrote:
>> Not in the modern kernel resource manager world: anyone who is in the
>> tpm group can access the tpmrm device and we haven't added a
>dangerous
>> command filter like we promised we would, so unless they have
>actually
>> set lockout or platform authorization, they'll find they can execute
>it
>
>The default for the tpm2_* tools with '-T device' switch is to talk to
>/dev/tpm0.
>
>If one would try to run it, by mistake, it would fail with:
>
>$ tpm2_clear -T device
>ERROR:tcti:src/tss2-tcti/tcti-device.c:439:Tss2_Tcti_Device_Init()
>Failed to open device file /dev/tpm0: Permission denied
>
>To point it to /dev/tpmrm0 it would need to be:
>$ tpm2_clear -T device:/dev/tpmrm0

And most other toolkits talk to the tpmrm device because the tpm 1.2 daemon based architecture didn't work so well.  The point is that if tpm2_clear works on your emulator, it likely works on your real tpm, so making the tests safer to run is not unreasonable.

James

-- 
Sent from my Android device with K-9 Mail. Please excuse my brevity.