- 03 Feb, 2017 8 commits
-
-
Nayna Jain authored
Unlike the device driver support for TPM 1.2, the TPM 2.0 does not support the securityfs pseudo files for displaying the firmware event log. This patch enables support for providing the TPM 2.0 event log in binary form. TPM 2.0 event log supports a crypto agile format that records multiple digests, which is different from TPM 1.2. This patch enables the tpm_bios_log_setup for TPM 2.0 and adds the event log parser which understand the TPM 2.0 crypto agile format. Signed-off-by:
Nayna Jain <nayna@linux.vnet.ibm.com> Reviewed-by:
Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> Tested-by:
Kenneth Goldman <kgold@linux.vnet.ibm.com> Tested-by:
Stefan Berger <stefanb@linux.vnet.ibm.com> Signed-off-by:
Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
-
Nayna Jain authored
Physical TPMs use Open Firmware Device Tree bindings that are similar to the IBM Power virtual TPM to support event log. However, these properties store the values in different endianness for Physical and Virtual TPM. This patch fixes the endianness issue by doing appropriate conversion based on Physical or Virtual TPM. Signed-off-by:
Nayna Jain <nayna@linux.vnet.ibm.com> Reviewed-by:
Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> Tested-by:
Kenneth Goldman <kgold@linux.vnet.ibm.com> Signed-off-by:
Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
-
Nayna Jain authored
The current TPM 2.0 device driver extends only the SHA1 PCR bank but the TCG Specification[1] recommends extending all active PCR banks, to prevent malicious users from setting unused PCR banks with fake measurements and quoting them. The existing in-kernel interface(tpm_pcr_extend()) expects only a SHA1 digest. To extend all active PCR banks with differing digest sizes, the SHA1 digest is padded with trailing 0's as needed. This patch reuses the defined digest sizes from the crypto subsystem, adding a dependency on CRYPTO_HASH_INFO module. [1] TPM 2.0 Specification referred here is "TCG PC Client Specific Platform Firmware Profile for TPM 2.0" Signed-off-by:
Nayna Jain <nayna@linux.vnet.ibm.com> Reviewed-by:
Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> Tested-by:
Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> Tested-by:
Kenneth Goldman <kgold@linux.vnet.ibm.com> Signed-off-by:
Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
-
Nayna Jain authored
This patch implements the TPM 2.0 capability TPM_CAP_PCRS to retrieve the active PCR banks from the TPM. This is needed to enable extending all active banks as recommended by TPM 2.0 TCG Specification. Signed-off-by:
Nayna Jain <nayna@linux.vnet.ibm.com> Reviewed-by:
Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> Tested-by:
Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> Tested-by:
Kenneth Goldman <kgold@linux.vnet.ibm.com> Signed-off-by:
Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
-
Jarkko Sakkinen authored
The error code handling is broken as any error code that has the same bits set as TPM_RC_HASH passes. Implemented tpm2_rc_value() helper to parse the error value from FMT0 and FMT1 error codes so that these types of mistakes are prevented in the future. Fixes: 5ca4c20c ("keys, trusted: select hash algorithm for TPM2 chips") Signed-off-by:
Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> Reviewed-by:
Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
-
Maciej S. Szmigiero authored
probe_itpm() function is supposed to send command without an itpm flag set and if this fails to repeat it, this time with the itpm flag set. However, commit 41a5e1cf ("tpm/tpm_tis: Split tpm_tis driver into a core and TCG TIS compliant phy") moved the itpm flag from an "itpm" variable to a TPM_TIS_ITPM_POSSIBLE chip flag, so setting the (now function-local) itpm variable no longer had any effect. Finally, this function-local itpm variable was removed by commit 56af3221 ("tpm/tpm_tis: remove unused itpm variable") Tested only on non-iTPM TIS TPM. Signed-off-by:
Maciej S. Szmigiero <mail@maciej.szmigiero.name> Reviewed-by:
Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> Signed-off-by:
Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
-
Jason Gunthorpe authored
For a long time the cdev read/write interface had this strange idea that userspace had to read the result within 60 seconds otherwise it is discarded. Perhaps this made sense under some older locking regime, but in the modern kernel it is not required and is just dangerous. Since something may be relying on this, double the timeout and print a warning. We can remove the code in a few years, but this should be enough to prevent new users. Suggested-by:
James Bottomley <James.Bottomley@HansenPartnership.com> Signed-off-by:
Jason Gunthorpe <jgunthorpe@obsidianresearch.com> Reviewed-by:
Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> Signed-off-by:
Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
-
Jarkko Sakkinen authored
These are non-generic functions and do not belong to tpm.h. Signed-off-by:
Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> Reviewed-by:
Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
-
- 27 Jan, 2017 2 commits
-
-
Lans Zhang authored
Otherwise some mask and inmask tokens with MAY_APPEND flag may not work as expected. Signed-off-by:
Lans Zhang <jia.zhang@windriver.com> Signed-off-by:
Mimi Zohar <zohar@linux.vnet.ibm.com>
-
Mimi Zohar authored
On failure to return a pathname from ima_d_path(), a pointer to dname is returned, which is subsequently used in the IMA measurement list, the IMA audit records, and other audit logging. Saving the pointer to dname for later use has the potential to race with rename. Intead of returning a pointer to dname on failure, this patch returns a pointer to a copy of the filename. Reported-by:
Al Viro <viro@zeniv.linux.org.uk> Signed-off-by:
Mimi Zohar <zohar@linux.vnet.ibm.com> Cc: stable@vger.kernel.org
-
- 26 Jan, 2017 1 commit
-
-
- 23 Jan, 2017 11 commits
-
-
Stefan Berger authored
Make sure that we have not received less bytes than what is indicated in the header of the TPM response. Also, check the number of bytes in the response before accessing its data. Signed-off-by:
Stefan Berger <stefanb@linux.vnet.ibm.com> Reviewed-by:
Jarkko Sakkinen <jarkko.sakkine@linux.intel.com> Tested-by:
Jarkko Sakkinen <jarkko.sakkine@linux.intel.com> Signed-off-by:
Jarkko Sakkinen <jarkko.sakkine@linux.intel.com>
-
Maciej S. Szmigiero authored
Since commit 1107d065 ("tpm_tis: Introduce intermediate layer for TPM access") Atmel 3203 TPM on ThinkPad X61S (TPM firmware version 13.9) no longer works. The initialization proceeds fine until we get and start using chip-reported timeouts - and the chip reports C and D timeouts of zero. It turns out that until commit 8e54caf4 ("tpm: Provide a generic means to override the chip returned timeouts") we had actually let default timeout values remain in this case, so let's bring back this behavior to make chips like Atmel 3203 work again. Use a common code that was introduced by that commit so a warning is printed in this case and /sys/class/tpm/tpm*/timeouts correctly says the timeouts aren't chip-original. Fixes: 1107d065 ("tpm_tis: Introduce intermediate layer for TPM access") Cc: stable@vger.kernel.org Signed-off-by:
Maciej S. Szmigiero <mail@maciej.szmigiero.name> Reviewed-by:
Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> Signed-off-by:
Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
-
Jason Gunthorpe authored
This is a regression when this code was reworked and made the error print unconditional. The original code deliberately suppressed printing of the first error message so it could quietly sense TPM_ERR_INVALID_POSTINIT. Fixes: a502feb67b47 ("tpm: Clean up reading of timeout and duration capabilities") Signed-off-by:
Jason Gunthorpe <jgunthorpe@obsidianresearch.com> Reviewed-by:
Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> Signed-off-by:
Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
-
Jiandi An authored
crb_check_resource() in TPM CRB driver calls acpi_dev_resource_memory() which only handles 32-bit resources. Adding a call to acpi_dev_resource_address_space() in TPM CRB driver which handles 64-bit resources. Signed-off-by:
Jiandi An <anjiandi@codeaurora.org> Reviewed-by:
Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> Tested-by:
Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> Signed-off-by:
Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
-
Geliang Tang authored
Drop duplicate header module.h from tpm_tis_spi.c. Signed-off-by:
Geliang Tang <geliangtang@gmail.com> Reviewed-by:
Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> Signed-off-by:
Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
-
Corentin Labbe authored
tpm/st33zp24/st33zp24.c does not use any miscdevice so this patch remove this unnecessary inclusion. Signed-off-by:
Corentin Labbe <clabbe.montjoie@gmail.com> Reviewed-by:
Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> Signed-off-by:
Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
-
Winkler, Tomas authored
Use corret kdoc format for function description and eliminate warning of type: tpm_ibmvtpm.c:66: warning: No description found for parameter 'count' Signed-off-by:
Tomas Winkler <tomas.winkler@intel.com> Reviewed-by:
Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> Tested-by:
Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> Signed-off-by:
Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
-
Winkler, Tomas authored
The tpm stack uses pdev name convention for the parent device. Fix that also in tpm_chip_alloc(). Fixes: 3897cd9c ("tpm: Split out the devm stuff from tpmm_chip_alloc")' Signed-off-by:
Tomas Winkler <tomas.winkler@intel.com> Reviewed-by:
Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> Tested-by:
Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> Signed-off-by:
Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
-
Winkler, Tomas authored
Use correct kdoc format, describe correct parameters and return values. Signed-off-by:
Tomas Winkler <tomas.winkler@intel.com> Reviewed-by:
Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> Tested-by:
Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> Signed-off-by:
Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
-
Winkler, Tomas authored
Functions tpm_transmit and transmit_cmd are referenced from other functions kdoc hence deserve documentation. Signed-off-by:
Tomas Winkler <tomas.winkler@intel.com> Reviewed-by:
Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> Tested-by:
Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> Signed-off-by:
Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
-
Mike Frysinger authored
The SECCOMP_RET_KILL mode is documented as immediately killing the process as if a SIGSYS had been sent and not caught (similar to a SIGKILL). However, a SIGSYS is documented as triggering a coredump which does not happen today. This has the advantage of being able to more easily debug a process that fails a seccomp filter. Today, most apps need to recompile and change their filter in order to get detailed info out, or manually run things through strace, or enable detailed kernel auditing. Now we get coredumps that fit into existing system-wide crash reporting setups. From a security pov, this shouldn't be a problem. Unhandled signals can already be sent externally which trigger a coredump independent of the status of the seccomp filter. The act of dumping core itself does not cause change in execution of the program. URL: https://crbug.com/676357Signed-off-by:
Mike Frysinger <vapier@chromium.org> Acked-by:
Jorge Lucangeli Obes <jorgelo@chromium.org> Acked-by:
Kees Cook <keescook@chromium.org> Signed-off-by:
James Morris <james.l.morris@oracle.com>
-
- 19 Jan, 2017 1 commit
-
-
Casey Schaufler authored
I am still tired of having to find indirect ways to determine what security modules are active on a system. I have added /sys/kernel/security/lsm, which contains a comma separated list of the active security modules. No more groping around in /proc/filesystems or other clever hacks. Unchanged from previous versions except for being updated to the latest security next branch. Signed-off-by:
Casey Schaufler <casey@schaufler-ca.com> Acked-by:
John Johansen <john.johansen@canonical.com> Acked-by:
Paul Moore <paul@paul-moore.com> Acked-by:
Kees Cook <keescook@chromium.org> Signed-off-by:
James Morris <james.l.morris@oracle.com>
-
- 16 Jan, 2017 17 commits
-
-
John Johansen authored
The kernel build bot turned up a bad config combination when CONFIG_SECURITY_APPARMOR is y and CONFIG_SECURITY_APPARMOR_HASH is n, resulting in the build error security/built-in.o: In function `aa_unpack': (.text+0x841e2): undefined reference to `aa_g_hash_policy' Signed-off-by:
John Johansen <john.johansen@canonical.com>
-
John Johansen authored
AA_BUG() uses WARN and won't break the kernel like BUG_ON(). Signed-off-by:
John Johansen <john.johansen@canonical.com>
-
John Johansen authored
Signed-off-by:
John Johansen <john.johansen@canonical.com>
-
John Johansen authored
Signed-off-by:
John Johansen <john.johansen@canonical.com>
-
John Johansen authored
Signed-off-by:
John Johansen <john.johansen@canonical.com>
-
John Johansen authored
Signed-off-by:
John Johansen <john.johansen@canonical.com>
-
Tyler Hicks authored
If this sysctl is set to non-zero and a process with CAP_MAC_ADMIN in the root namespace has created an AppArmor policy namespace, unprivileged processes will be able to change to a profile in the newly created AppArmor policy namespace and, if the profile allows CAP_MAC_ADMIN and appropriate file permissions, will be able to load policy in the respective policy namespace. Signed-off-by:
Tyler Hicks <tyhicks@canonical.com> Signed-off-by:
John Johansen <john.johansen@canonical.com>
-
William Hua authored
Allow a profile to carry extra data that can be queried via userspace. This provides a means to store extra data in a profile that a trusted helper can extract and use from live policy. Signed-off-by:
William Hua <william.hua@canonical.com> Signed-off-by:
John Johansen <john.johansen@canonical.com>
-
John Johansen authored
apparmor should be checking the SECURITY_CAP_NOAUDIT constant. Also in complain mode make it so apparmor can elect to log a message, informing of the check. Signed-off-by:
John Johansen <john.johansen@canonical.com>
-
John Johansen authored
Allow turning off the computation of the policy hashes via the apparmor.hash_policy kernel parameter. Signed-off-by:
John Johansen <john.johansen@canonical.com>
-
John Johansen authored
Moving the use of fqname to later allows learning profiles to be based on the fqname request instead of just the hname. It also allows cleaning up some of the name parsing and lookup by allowing the use of the fqlookupn_profile() lib fn. Signed-off-by:
John Johansen <john.johansen@canonical.com>
-
John Johansen authored
Signed-off-by:
John Johansen <john.johansen@canonical.com>
-
John Johansen authored
Signed-off-by:
John Johansen <john.johansen@canonical.com>
-
John Johansen authored
The aad macro can replace aad strings when it is not intended to. Switch to a fn macro so it is only applied when intended. Also at the same time cleanup audit_data initialization by putting common boiler plate behind a macro, and dropping the gfp_t parameter which will become useless. Signed-off-by:
John Johansen <john.johansen@canonical.com>
-
John Johansen authored
Having ops be an integer that is an index into an op name table is awkward and brittle. Every op change requires an edit for both the op constant and a string in the table. Instead switch to using const strings directly, eliminating the need for the table that needs to be kept in sync. Signed-off-by:
John Johansen <john.johansen@canonical.com>
-
John Johansen authored
Signed-off-by:
John Johansen <john.johansen@canonical.com>
-
John Johansen authored
Trying to update the task cred while the task current cred is not the real cred will result in an error at the cred layer. Avoid this by failing early and delaying the update. Signed-off-by:
John Johansen <john.johansen@canonical.com>
-