Proxmox-Port/swtpm
1
0
Fork 0
mirror of https://github.com/stefanberger/swtpm.git synced 2026-08-18 12:40:19 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

swtpm_setup: Switch over to new python tool and get rid of the bash script

Browse Source 
Switch over to the new python implementation of swtpm_setup. We need to
also adjust test cases that involved the tcsd that otherwise fail for
various reasons. For in-place testing we need to adjust the PYTHONPATH
and PATH so that swtpm_setup.py can be found and so that swtpm_setup.py
then finds swtpm if it is not explicitly passed as parameter.

Adjust the man page for swtpm_setup to reflect the changes.

We now can run swtpm_setup as any user. However, libvirt still runs it
as tss:tss (for example), which is then creating the signing key as tss:tss
as well. Ideally libvirt would run it as tss:root or any other combination
since the tss group may be used for user wanting to access /dev/tpmrm0 for
example. We at least change the directory ownership of /var/lib/swtpm-localca
to tss:root and keep the world out of this directory.

Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
This commit is contained in:
Stefan Berger 2020-08-24 10:45:34 -04:00 committed by Stefan Berger
parent eee8cb5dfb
commit cc410ca91b
20 changed files with 197 additions and 2836 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
.gitignore vendored
View File

@ -56,8 +56,6 @@ Makefile
/src/swtpm_ioctl/swtpm_ioctl
/src/swtpm_setup/dist
/src/swtpm_setup/swtpm_setup
/src/swtpm_setup/swtpm_setup.h
/src/swtpm_setup/swtpm_setup.sh
/src/swtpm_setup/py_swtpm_setup/swtpm_setup_conf.py
/test-driver
tests/*.log

52
configure.ac
View File

@ -179,14 +179,13 @@ AC_SUBST([LIBTPMS_LIBS])
AC_CHECK_LIB(c, clock_gettime, LIBRT_LIBS="", LIBRT_LIBS="-lrt")
AC_SUBST([LIBRT_LIBS])
AC_PATH_PROG([TPM_NVDEFINE], tpm_nvdefine)
if test "x$TPM_NVDEFINE" = "x"; then
AC_PATH_PROG([TCSD], tcsd)
if test "x$TCSD" = "x"; then
have_tcsd=no
AC_MSG_WARN([NVRAM area tools are needed for TPM 1.2 certificate injection: tpm-tools package])
AC_MSG_WARN([tcsd could not be found; typically need it for tss user account and tests])
else
have_tcsd=yes
fi
with_swtpm_setup=yes
AM_CONDITIONAL([HAVE_TCSD], test "$have_tcsd" != "no")
dnl If we have the tcsd package, we can build swtpm_setup, but need netstat also
@ -347,11 +346,40 @@ if test "x$FLOCK" = "x"; then
AC_MSG_ERROR([flock is required: flock package])
fi
AC_PATH_PROG([PYTHON], python3)
if test "x$PYTHON" = "x"; then
AC_MSG_ERROR([python3 is required])
AC_PATH_PROG([BASE64], base64)
if test "x$BASE64" = "x"; then
AC_MSG_ERROR([base64 is required: base64 package])
fi
AC_PATH_PROG([CP], cp)
if test "x$CP" = "x"; then
AC_MSG_ERROR([cp is required])
fi
AM_PATH_PYTHON([3.3])
AC_PATH_PROG([PIP3], pip3)
if test "x$PIP3" = "x"; then
AC_PATH_PROG([PIP3], pip)
if test "x$PIP3" = "x"; then
AC_MSG_ERROR([pip3 is required])
else
AC_MSG_WARN([Using pip as pip3 tool])
fi
fi
AC_MSG_CHECKING([for python setuptools package])
$PYTHON -c "import setuptools"
AS_IF([ test $? = 0 ],
[AC_MSG_RESULT([yes])],
[AC_MSG_ERROR([python setuptools is required])])
AC_MSG_CHECKING([for python cryptography package])
$PYTHON -c "import cryptography"
AS_IF([ test $? = 0 ],
[AC_MSG_RESULT([yes])],
[AC_MSG_ERROR([python setuptools is required])])
AC_ARG_ENABLE([hardening],
AS_HELP_STRING([--disable-hardening], [Disable hardening flags]))
@ -526,7 +554,6 @@ AC_CONFIG_FILES([Makefile \
src/swtpm_cert/Makefile \
src/swtpm_ioctl/Makefile \
src/swtpm_setup/Makefile \
src/swtpm_setup/swtpm_setup.h \
src/swtpm_setup/py_swtpm_setup/swtpm_setup_conf.py \
man/Makefile \
man/man3/Makefile \
@ -534,10 +561,14 @@ AC_CONFIG_FILES([Makefile \
tests/Makefile \
tests/test_config \
])
AC_CONFIG_FILES([src/swtpm_setup/swtpm_setup.sh],
[chmod 755 src/swtpm_setup/swtpm_setup.sh])
AC_CONFIG_FILES([samples/swtpm-localca],
[chmod 755 samples/swtpm-localca])
dnl for out-of-tree builds:
AC_CONFIG_LINKS([src/swtpm_setup/swtpm_setup.sh:src/swtpm_setup/swtpm_setup.sh \
src/swtpm_setup/py_swtpm_setup/__init__.py:src/swtpm_setup/py_swtpm_setup/__init__.py \
src/swtpm_setup/py_swtpm_setup/swtpm.py:src/swtpm_setup/py_swtpm_setup/swtpm.py \
src/swtpm_setup/py_swtpm_setup/swtpm_utils.py:src/swtpm_setup/py_swtpm_setup/swtpm_utils.py \
src/swtpm_setup/py_swtpm_setup/swtpm_setup.py:src/swtpm_setup/py_swtpm_setup/swtpm_setup.py])
AC_OUTPUT
echo
@ -545,7 +576,6 @@ printf "with_gnutls : %5s (no = swtpm_cert will NOT be built)\n" $with_gnut
printf "with_selinux : %5s (no = SELinux policy extensions will NOT be built)\n" $with_selinux
printf "with_cuse : %5s (no = no CUSE interface)\n" $with_cuse
printf "with_chardev : %5s (no = no chardev interface)\n" $with_chardev
printf "with_swtpm_setup: %5s (no = swtpm_setup will NOT be built)\n" $with_swtpm_setup
printf "with_vtpm_proxy : %5s (no = no vtpm proxy support; Linux only)\n" $with_vtpm_proxy
printf "with_seccomp : %5s (no = no seccomp profile; Linux only)\n" $with_seccomp
echo

34
man/man8/swtpm_setup.pod
View File

@ -11,16 +11,13 @@ B<swtpm_setup [OPTIONS]>
B<swtpm_setup> is a tool that prepares the initial state for a libtpms-based
TPM.
For creating the initial state of a TPM 1.2, swtpm_setup must be run either
as root or as the user the that tcsd requires, which is typically tss.
The following options are supported:
=over 4
=item B<--runas <userid>>
Use this userid to run swtpm_setup.sh; by default 'tss' is used.
Use this userid to run swtpm_setup.sh as. Only 'root' can use this option.
=item B<--config <file>>
@ -171,11 +168,7 @@ in the PATH is used.
=item B<--tcsd-system-ps-file <file>>
A file to copy TCSD's system_ps_file to. The system_ps_file contains the
TPM 1.2 SRK public key after taking ownership of the TPM. The file is
needed by TCSD for key related functions.
This option is only useful with TPM 1.2 and in if ownership is taken.
This option is deprecated and has no effect (since v0.4).
=item B<--rsa-keysize <keysize>> (since v0.4)
@ -195,9 +188,9 @@ The output may contain the following:
"features": [
"cmdarg-keyfile-fd",
"cmdarg-pwdfile-fd",
"no-tpm12-tools",
"tpm2-rsa-keysize-2048",
"tpm2-rsa-keysize-3072"
"tpm2-rsa-keysize-3072",
"tpm12-not-need-root"
]
}
@ -213,17 +206,17 @@ The I<--keyfile-fd> option is supported.
The I<--pwdfile-fd> option is supported.
=item B<no-tpm12-tools>
TPM 1.2 tools cannot be found in the PATH. This means that no certificates can
be created since they cannot be written into the NVRAM and the NVRAM cannot be
locked. Among the TPM 1.2 setup parameters only I<--createek> can be passed.
=item B<tpm2-rsa-keysize-2048, ...>
The shown RSA key sizes are supported for a TPM 2's EK key. If none of the
tpm2-rsa-keysize verbs is shown then only RSA 2048 bit keys are supported.
=item B<tpm12-not-need-root> (since 0.4.0)
This option implies that any user can setup a TPM 1.2. Previously only root
or the 'tss' user, depending on configuration and availability of this account,
could do that.
=back
=item B<--help, -h>
@ -239,12 +232,9 @@ To simulate manufacturing of a TPM, one would typically run the following comman
#> sudo swtpm_setup --tpmstate /tmp/mytpm1/ \
--create-ek-cert --create-platform-cert --lock-nvram
Note: since setting up a TPM 1.2 relies on the I<tcsd> for some of its operations,
B<swtpm_setup> has to be run as root so that it can invoke the I<tcsd> either as root
or tss user.
Note: since v0.4 TPM 1.2 setup does not require root rights anymore.
A normal user can also simulate the manufacturing of a TPM 2 using the
Any user can also simulate the manufacturing of a TPM using the
swtpm-localca plugin. The following example assumes that the user has
set the environment variable XDG_CONFIG_HOME as follows (using bash for
example):

3
samples/Makefile.am
View File

@ -19,7 +19,8 @@ samplessysconf_DATA = \
install-data-local:
$(MKDIR_P) $(DESTDIR)$(localstatedir)/lib/swtpm-localca
if test -z $(DESTDIR); then \
chown @TSS_USER@:@TSS_GROUP@ $(DESTDIR)$(localstatedir)/lib/swtpm-localca || true; \
chown -R @TSS_USER@:root $(DESTDIR)$(localstatedir)/lib/swtpm-localca || true; \
chmod 0750 $(DESTDIR)$(localstatedir)/lib/swtpm-localca || true; \
fi
EXTRA_DIST= \

50
src/swtpm_setup/Makefile.am
View File

@ -4,9 +4,6 @@
# For the license, see the LICENSE file in the root directory.
#
noinst_HEADERS = \
swtpm_setup.h
bin_PROGRAMS = \
swtpm_setup
@ -14,7 +11,54 @@ swtpm_setup_SOURCES = swtpm_setup.c
dist_bin_SCRIPTS = swtpm_setup.sh
PY_SWTPM_SETUP_FILES = $(wildcard py_swtpm_setup/*.py)
PY_PACKAGE_NAME=swtpm_setup
PY_PACKAGE_NV=$(PY_PACKAGE_NAME)-$(SWTPM_VER_MAJOR).$(SWTPM_VER_MINOR).$(SWTPM_VER_MICRO)
PY_PACKAGE=dist/$(PY_PACKAGE_NV).tar.gz
# for out-of-tree builds we need to copy setup.py
$(PY_PACKAGE): $(PY_SWTPM_SETUP_FILES)
@$(CP) $(srcdir)/setup.py ./ &>/dev/null || true
./setup.py sdist
all-local: $(PY_PACKAGE)
# for in-tree testing on Cygwin we need to copy swtpm_setup.exe
# for it to find swtpm_setup.sh
all:
@if test "$(host_os)" = "cygwin"; then \
$(CP) -f .libs/swtpm_setup.exe ./ ; \
fi
install-exec-local: $(PY_PACKAGE)
@if ! test $(findstring /usr, "$(DESTDIR)$(bindir)"); then \
echo "Warning: Not installing python package to $(DESTDIR)$(bindir)"; \
else \
echo "Installing python to DESTDIR '/$(DESTDIR)'"; \
./setup.py install --prefix=$(prefix) --root "/$(DESTDIR)" --install-layout deb 2>/dev/null || \
./setup.py install --prefix=$(prefix) --root "/$(DESTDIR)" 2>/dev/null ; \
fi
uninstall-local:
@if ! test $(findstring /usr, "$(DESTDIR)$(bindir)"); then \
echo "Cleanup for distcheck build not implemented" ; \
else \
echo "Local pip3 uninstall"; \
$(PIP3) uninstall -y $(PY_PACKAGE_NAME); \
fi
# for out-of-tree builds we need to clean up
clean-local:
if test "$(top_srcdir)" != "$(top_builddir)"; then \
rm -f setup.py; \
fi
rm -rf py_swtpm_setup/__pycache__/
rm -rf swtpm_setup.egg-info/
rm -rf dist
EXTRA_DIST = \
setup.py \
README
CLEANFILES = *.gcno *.gcda *.gcov

37
src/swtpm_setup/swtpm_setup.c
View File

@ -54,8 +54,6 @@
#include <mach-o/dyld.h>
#endif
#include "swtpm_setup.h"
/*
* Those parameters interpreted by swtpm_setup.sh that have an additional
* parameter.
@ -181,10 +179,8 @@ int main(int argc, char *argv[])
size_t length;
struct passwd *passwd = NULL;
int i = 1, j;
const char *userid = E_USER_ID;
const char *userid = NULL;
bool change_user = true;
bool use_tpm2 = false;
bool have_runas = false;
const char *p;
#if defined __APPLE__
char path[MAXPATHLEN];
@ -197,19 +193,16 @@ int main(int argc, char *argv[])
if (!strcmp("--runas", argv[i])) {
i++;
if (i == argc) {
fprintf(stderr, "Missing user argument for --runas");
fprintf(stderr, "Missing user argument for --runas\n");
exit(1);
}
userid = argv[i];
have_runas = true;
} else if (!strcmp("--help", argv[i]) || !strcmp("-h", argv[i])) {
change_user = false;
} else if (!strcmp("--version", argv[i])) {
change_user = false;
} else if (!strcmp("--print-capabilities", argv[i])) {
change_user = false;
} else if (!strcmp("--tpm2", argv[i])) {
use_tpm2 = true;
}
for (j = 0; one_arg_params[j] != NULL; j++) {
if (!strcmp(one_arg_params[j], argv[i])) {
@ -281,30 +274,10 @@ skip:
}
/*
* In case of TPM2 we don't require to run as root since none
* of the tools we will run require root priviliges similar to
* TrouSerS (tcsd). So unless we saw --runas, we will not attempt
* to switch the user.
* Unless we saw --runas, we will not attempt to switch the user.
*/
if (use_tpm2) {
if (!have_runas) {
change_user = false;
}
}
/*
* In case of TPM 1.2 we allow running this program as 'tss'
* (E_USER_ID).
*/
if (!use_tpm2 && change_user) {
passwd = getpwnam(E_USER_ID);
if (!passwd) {
fprintf(stderr, "Could not get account data of user %s.\n", E_USER_ID);
goto exit_failure;
}
if (passwd->pw_uid == geteuid())
change_user = false;
}
if (!userid)
change_user = false;
if (change_user && change_process_owner(userid))
goto exit_failure;

42
src/swtpm_setup/swtpm_setup.h.in
View File

@ -1,42 +0,0 @@
/*
* swtpm_setup.h
*
* Authors: Stefan Berger <stefanb@us.ibm.com>
*
* (c) Copyright IBM Corporation 2015.
*
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions are
* met:
*
* Redistributions of source code must retain the above copyright notice,
* this list of conditions and the following disclaimer.
*
* Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* Neither the names of the IBM Corporation nor the names of its
* contributors may be used to endorse or promote products derived from
* this software without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
* HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/
#ifndef _SWTPM_SETUP_H_
#define _SWTPM_SETUP_H_
#define E_USER_ID "@TSS_USER@"
#endif /* _SWTPM_SETUP_H_ */

10
src/swtpm_setup/swtpm_setup.sh Executable file
View File

@ -0,0 +1,10 @@
#!/usr/bin/env bash
python3 -c "
import sys;
from py_swtpm_setup.swtpm_setup import main
sys.argv.pop(0)
sys.argv[0]='$0'
main()" \
- "$@"

2609
src/swtpm_setup/swtpm_setup.sh.in
View File

File diff suppressed because it is too large Load Diff

14
tests/Makefile.am
View File

@ -23,6 +23,7 @@ TESTS += \
endif
TESTS += \
test_commandline \
test_ctrlchannel \
test_ctrlchannel3 \
test_encrypted_state \
@ -32,6 +33,7 @@ TESTS += \
test_init \
test_locality \
test_migration_key \
test_parameters \
test_resume_volatile \
test_save_load_encrypted_state \
test_save_load_state \
@ -70,17 +72,12 @@ TESTS += \
\
test_tpm2_ibmtss2
if HAVE_TCSD
TESTS += \
test_commandline \
test_parameters
endif
if WITH_GNUTLS
TESTS += \
test_samples_create_tpmca \
test_swtpm_cert \
test_swtpm_setup_create_cert \
test_tpm2_parameters \
test_tpm2_samples_create_tpmca \
test_tpm2_samples_swtpm_localca \
test_tpm2_samples_swtpm_localca_pkcs11 \
test_tpm2_swtpm_cert \
@ -88,8 +85,7 @@ TESTS += \
test_tpm2_swtpm_setup_create_cert
if HAVE_TCSD
TESTS += \
test_swtpm_setup_create_cert \
test_samples_create_tpmca
test_tpm2_samples_create_tpmca
endif
endif

6
tests/_test_print_capabilities
View File

@ -6,6 +6,10 @@
ROOT=${abs_top_builddir:-$(pwd)/..}
TESTDIR=${abs_top_testdir:-$(dirname "$0")}
# We need to be able to find swtpm_setup.py and swtpm_setup.py needs to find swtpm
export PYTHONPATH=$ROOT/src/swtpm_setup
PATH=$ROOT/src/swtpm:$PATH
[ "${SWTPM_IFACE}" == "cuse" ] && source ${TESTDIR}/test_cuse
source ${TESTDIR}/common
@ -41,7 +45,7 @@ if [ $? -ne 0 ]; then
fi
# The are some variable parameters at the end, use regex
exp='\{ "type": "swtpm_setup", "features": \[ "cmdarg-keyfile-fd", "cmdarg-pwdfile-fd"(, "no-tpm12-tools")?(, "tpm2-rsa-keysize-2048")?(, "tpm2-rsa-keysize-3072")? \] \}'
exp='\{ "type": "swtpm_setup", "features": \[ "cmdarg-keyfile-fd", "cmdarg-pwdfile-fd", "tpm12-not-need-root"(, "tpm2-rsa-keysize-2048")?(, "tpm2-rsa-keysize-3072")? \] \}'
if ! [[ ${msg} =~ ${exp} ]]; then
echo "Unexpected response from ${SWTPM_SETUP} to --print-capabilities:"
echo "Actual : ${msg}"

6
tests/_test_tpm2_print_capabilities
View File

@ -6,6 +6,10 @@
ROOT=${abs_top_builddir:-$(pwd)/..}
TESTDIR=${abs_top_testdir:-$(dirname "$0")}
# We need to be able to find swtpm_setup.py and swtpm_setup.py needs to find swtpm
export PYTHONPATH=$ROOT/src/swtpm_setup
PATH=$ROOT/src/swtpm:$PATH
[ "${SWTPM_IFACE}" == "cuse" ] && source ${TESTDIR}/test_cuse
source ${TESTDIR}/common
@ -42,7 +46,7 @@ if [ $? -ne 0 ]; then
fi
# The are some variable parameters at the end, use regex
exp='\{ "type": "swtpm_setup", "features": \[ "cmdarg-keyfile-fd", "cmdarg-pwdfile-fd"(, "no-tpm12-tools")?(, "tpm2-rsa-keysize-2048")?(, "tpm2-rsa-keysize-3072")? \] \}'
exp='\{ "type": "swtpm_setup", "features": \[ "cmdarg-keyfile-fd", "cmdarg-pwdfile-fd", "tpm12-not-need-root"(, "tpm2-rsa-keysize-2048")?(, "tpm2-rsa-keysize-3072")? \] \}'
if ! [[ ${msg} =~ ${exp} ]]; then
echo "Unexpected response from ${SWTPM_SETUP} to --print-capabilities:"
echo "Actual : ${msg}"

6
tests/test_commandline
View File

@ -2,6 +2,12 @@
# For the license, see the LICENSE file in the root directory.
if [ "$(uname -s)" != "Linux" ]; then
# Due to netstat
echo "This test only runs only Linux."
exit 77
fi
ROOT=${abs_top_builddir:-$(dirname "$0")/..}
TESTDIR=${abs_top_testdir:=$(dirname "$0")}

31
tests/test_parameters
View File

@ -6,6 +6,10 @@ ROOT=${abs_top_builddir:-$(dirname "$0")/..}
TESTDIR=${abs_top_testdir:=$(dirname "$0")}
SRCDIR=${abs_top_srcdir:-$(dirname "$0")/..}
# We need to be able to find swtpm_setup.py and swtpm_setup.py needs to find swtpm
export PYTHONPATH=$ROOT/src/swtpm_setup
PATH=$ROOT/src/swtpm:$PATH
PARAMETERS=(
""
"--createek"
@ -60,43 +64,23 @@ FILESIZES=(
1820
)
if [ "$(id -u)" -ne 0 ]; then
echo "Need to be root to run this test."
exit 77
fi
source ${TESTDIR}/common
source ${TESTDIR}/test_config
SWTPM=swtpm
SWTPM_EXE=${SWTPM_EXE:-$ROOT/src/swtpm/$SWTPM}
SWTPM_IOCTL=${SWTPM_IOCTL:-$ROOT/src/swtpm_ioctl/swtpm_ioctl}
TCSD=$(type -P tcsd)
TPMDIR=$(mktemp -d)
SWTPM_SETUP_CONF=$SRCDIR/etc/swtpm_setup.conf
# filesystem privileges require to run swtpm_setup as root during test
TPMAUTHORING="$ROOT/src/swtpm_setup/swtpm_setup --config ${SWTPM_SETUP_CONF} --runas root"
TPMAUTHORING="$ROOT/src/swtpm_setup/swtpm_setup --config ${SWTPM_SETUP_CONF}"
PATH=${ROOT}/src/swtpm_bios:${TESTDIR}:$PATH
trap "cleanup" SIGTERM EXIT
if test "$TCSD" = ""; then
echo "TCSD executable 'tcsd' was not found in path."
exit 1
fi
function cleanup()
{
rm -rf $TPMDIR
}
chown $TSS_USER:$TSS_GROUP $TPMDIR 2>/dev/null
if [ $? -ne 0 ]; then
echo "Could not change ownership of $TPMDIR to $TSS_USER:$TSS_GROUP." \
"You need to be root."
exit 1
fi
# swtpm_setup.conf points to the local create_certs.sh
# For create_certs.sh to be found (with out full path)
# add this directory to the PATH
@ -108,9 +92,8 @@ for (( i=0; i<${#PARAMETERS[*]}; i++)); do
$TPMAUTHORING \
--tpm-state $TPMDIR \
--tpm "$SWTPM_EXE socket ${SWTPM_TEST_SECCOMP_OPT}" \
--swtpm_ioctl "$SWTPM_IOCTL" \
${PARAMETERS[$i]} 2>&1 >/dev/null
if [ $? -ne 0 ]; then
echo "ERROR: Test with parameters '${PARAMETERS[$i]}' failed."
exit 1
@ -150,3 +133,5 @@ done
exec 100>&-
exec 101>&-
exit 0

73
tests/test_samples_create_tpmca
View File

@ -18,6 +18,12 @@ ROOT=${abs_top_builddir:-$(dirname "$0")/..}
TESTDIR=${abs_top_testdir:=$(dirname "$0")}
SRCDIR=${abs_top_srcdir:-$(dirname "$0")/..}
# We need to be able to find swtpm_setup.py and swtpm_setup.py needs to find swtpm
export PYTHONPATH=$ROOT/src/swtpm_setup
PATH=$ROOT/src/swtpm:$PATH
source ${abs_top_builddir:-$(dirname "$0")/..}/tests/test_config
SWTPM_SETUP=${ROOT}/src/swtpm_setup/swtpm_setup
SWTPM_CREATE_TPMCA=${SRCDIR}/samples/swtpm-create-tpmca
SWTPM_LOCALCA=${SRCDIR}/samples/swtpm-localca
@ -42,6 +48,19 @@ TCSD_PIDFILE=${workdir}/tcsd.pid
SWTPM_LOCALCA_DIR="${workdir}/my localca"
SWTPM_LOCALCA_CONF="${workdir}/my localca/swtpm-localca.conf"
# Captured TCSD file when using a SRK_PASSWORD=srk
TCSD_FILE="AQEAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAABLwEAAAAAAwAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAQEAAAARAAAAAAEAAAABAAMAAQAAAAwAAAgAAAAAAgAAAAAAAAAA
AAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
function cleanup()
{
if [ -n "${TCSD_PID}" ]; then
@ -93,11 +112,7 @@ _EOF_
else
params="${params} --owner-well-known"
fi
if [ -n "${srk_password}" ]; then
params="${params} --srkpass ${srk_password}"
else
params="${params} --srk-well-known"
fi
params="${params} --srkpass ${srk_password}"
# First setup the TPM and take ownership of it and set SRK password
$SWTPM_SETUP \
@ -106,10 +121,8 @@ _EOF_
--logfile "${workdir}/logfile" \
--config "${workdir}/swtpm_setup.conf" \
--tpm "${SWTPM_EXE} socket ${SWTPM_TEST_SECCOMP_OPT}" \
--swtpm_ioctl "${SWTPM_IOCTL}" \
--take-ownership \
${params} \
--tcsd-system-ps-file "${TCSD_SYSTEM_PS_FILE}" >/dev/null
${params} >/dev/null
if [ $? -ne 0 ]; then
echo "Error: Could not run $SWTPM_SETUP."
@ -136,14 +149,20 @@ _EOF_
exit 1
fi
echo "$TCSD_FILE" | base64 -d > "${TCSD_SYSTEM_PS_FILE}"
# Setup the TCSD config file and start TCSD with it
cat <<_EOF_ > "${TCSD_CONF}"
port = ${TCSD_LISTEN_PORT}
system_ps_file = ${TCSD_SYSTEM_PS_FILE}
_EOF_
chown tss:tss "${TCSD_CONF}"
chmod 0600 "${TCSD_CONF}"
chown ${TSS_USER}:${TSS_GROUP} "${TCSD_CONF}"
if [ "${TSS_USER}" == "${TSS_GROUP}" ]; then
chmod 0600 "${TCSD_CONF}"
else
chmod 0640 "${TCSD_CONF}"
fi
bash -c "TCSD_USE_TCP_DEVICE=1 TCSD_TCP_DEVICE_PORT=${SWTPM_SERVER_PORT} tcsd -c "${TCSD_CONF}" -e -f &>/dev/null & echo \$! > "${TCSD_PIDFILE}"; wait" &
BASH_PID=$!
@ -160,17 +179,11 @@ _EOF_
exit 1
fi
if [ -n "${srk_password}" ]; then
params="--srk-password ${srk_password}"
else
params=""
fi
${SWTPM_CREATE_TPMCA} \
--dir "${SWTPM_LOCALCA_DIR}" \
${params} \
--srk-password "${srk_password}" \
--register \
--group tss \
--group "${TSS_GROUP}" \
--tss-tcsd-port "${TCSD_LISTEN_PORT}" \
--outfile "${SWTPM_LOCALCA_CONF}" &>/dev/null
@ -305,28 +318,4 @@ echo "Test 3: OK"
run_test "" "${SRK_PASSWORD}" 0
echo "Test 4: OK"
# Repeat the test with the SRK having the well known password of 20 zero bytes
# We will have to check the help screen of swtpm-create-tpmca for whether
# it supports it, which in turn depends on tpmtool supporting it...
if [ -n "$(${SWTPM_CREATE_TPMCA} --help | grep "use 'well known' password if")" ]; then
run_test "${OWNER_PASSWORD}" "" 1
echo "Test 5: OK"
run_test "${OWNER_PASSWORD}" "" 0
echo "Test 6: OK"
run_test "" "" 1
echo "Test 7: OK"
run_test "" "" 0
echo "Test 8: OK"
else
if [ -n "$(tpmtool --help | grep srk-well-known)" ]; then
echo "Error: tpmtool seems to support --srk-well-known"
exit 1
fi
echo "tpmtool does not seem to support --srk-well-known"
echo "Tests 5..8: SKIP"
fi
exit 0

15
tests/test_swtpm_setup_create_cert
View File

@ -2,19 +2,18 @@
# For the license, see the LICENSE file in the root directory.
if [ "$(id -u)" -ne 0 ]; then
echo "Need to be root to run this test."
exit 77
fi
ROOT=${abs_top_builddir:-$(dirname "$0")/..}
TESTDIR=${abs_top_testdir:=$(dirname "$0")}
SRCDIR=${abs_top_srcdir:-$(dirname "$0")/..}
# We need to be able to find swtpm_setup.py and swtpm_setup.py needs to find swtpm
export PYTHONPATH=$ROOT/src/swtpm_setup
PATH=$ROOT/src/swtpm:$PATH
SWTPM_SETUP=${ROOT}/src/swtpm_setup/swtpm_setup
SWTPM_LOCALCA=${SRCDIR}/samples/swtpm-localca
SWTPM_LOCALCA=${ROOT}/samples/swtpm-localca
SWTPM=${ROOT}/src/swtpm/swtpm
SWTPM_IOCTL=${ROOT}/src/swtpm_ioctl/swtpm_ioctl
workdir=$(mktemp -d)
@ -65,13 +64,11 @@ export SWTPM_ROOTCA_PASSWORD=password
# we need to create at least one cert: --create-ek-cert
$SWTPM_SETUP \
--runas root \
--tpm-state ${workdir} \
--create-ek-cert \
--config ${workdir}/swtpm_setup.conf \
--logfile ${workdir}/logfile \
--tpm "${SWTPM} socket ${SWTPM_TEST_SECCOMP_OPT}" \
--swtpm_ioctl ${SWTPM_IOCTL}
--tpm "${SWTPM} socket ${SWTPM_TEST_SECCOMP_OPT}"
if [ $? -ne 0 ]; then
echo "Error: Could not run $SWTPM_SETUP."

24
tests/test_tpm2_parameters
View File

@ -6,6 +6,12 @@ ROOT=${abs_top_builddir:-$(dirname "$0")/..}
TESTDIR=${abs_top_testdir:-$(dirname "$0")}
SRCDIR=${abs_top_srcdir:-$(dirname "$0")/..}
# We need to be able to find swtpm_setup.py and swtpm_setup.py needs to find swtpm
export PYTHONPATH=$ROOT/src/swtpm_setup
PATH=$ROOT/src/swtpm:$PATH
source ${abs_top_builddir:-$(dirname "$0")/..}/tests/test_config
PARAMETERS=(
""
"--createek"
@ -52,21 +58,13 @@ exec 101<${TESTDIR}/data/pwdfile.txt
# produced file size is always the same with TPM2
if [ "$(id -u)" -ne 0 ]; then
echo "Need to be root to run this test."
exit 77
fi
SWTPM=swtpm
SWTPM_EXE=$ROOT/src/swtpm/$SWTPM
TPMDIR=$(mktemp -d)
SWTPM_SETUP_CONF=$SRCDIR/etc/swtpm_setup.conf
SWTPM_IOCTL=$ROOT/src/swtpm_ioctl/swtpm_ioctl
# filesystem privileges require to run swtpm_setup as root during test
TPMAUTHORING="$ROOT/src/swtpm_setup/swtpm_setup --tpm2 --config ${SWTPM_SETUP_CONF} --runas root"
TPMAUTHORING="$ROOT/src/swtpm_setup/swtpm_setup --tpm2 --config ${SWTPM_SETUP_CONF}"
PATH=${ROOT}/src/swtpm_bios:$PATH
source ${TESTDIR}/test_config
trap "cleanup" SIGTERM EXIT
@ -77,13 +75,6 @@ function cleanup()
fi
}
chown $TSS_USER:$TSS_GROUP $TPMDIR 2>/dev/null
if [ $? -ne 0 ]; then
echo "Could not change ownership of $TPMDIR to $TSS_USER:$TSS_GROUP." \
"You need to be root."
exit 1
fi
if [ -n "$($TPMAUTHORING --tpm2 --print-capabilities | grep tpm2-rsa-keysize-3072 )" ]; then
PARAMETERS+=( "${PARAMETERS_3072[@]}" )
fi
@ -99,7 +90,6 @@ for (( i=0; i<${#PARAMETERS[*]}; i++)); do
$TPMAUTHORING \
--tpm-state $TPMDIR \
--tpm "$SWTPM_EXE socket ${SWTPM_TEST_SECCOMP_OPT}" \
--swtpm_ioctl "$SWTPM_IOCTL" \
${PARAMETERS[$i]} 2>&1 >/dev/null
if [ $? -ne 0 ]; then

2
tests/test_tpm2_samples_swtpm_localca
View File

@ -7,7 +7,7 @@ TOPBUILD=${abs_top_builddir:-$(dirname "$0")/..}
TOPSRC=${abs_top_srcdir:-$(dirname "$0")/..}
TESTDIR=${abs_top_testdir:-$(dirname "$0")}
SWTPM_LOCALCA=${TOPSRC}/samples/swtpm-localca
SWTPM_LOCALCA=${TOPBUILD}/samples/swtpm-localca
workdir=$(mktemp -d "/tmp/path with spaces.XXXXXX")

2
tests/test_tpm2_samples_swtpm_localca_pkcs11
View File

@ -7,7 +7,7 @@ TOPBUILD=${abs_top_builddir:-$(dirname "$0")/..}
TOPSRC=${abs_top_srcdir:-$(dirname "$0")/..}
TESTDIR=${abs_top_testdir:-$(dirname "$0")}
SWTPM_LOCALCA=${TOPSRC}/samples/swtpm-localca
SWTPM_LOCALCA=${TOPBUILD}/samples/swtpm-localca
workdir=$(mktemp -d)
if [ $? -ne 0 ]; then

15
tests/test_tpm2_swtpm_setup_create_cert
View File

@ -6,10 +6,13 @@ TOPBUILD=${abs_top_builddir:-$(dirname "$0")/..}
TOPSRC=${abs_top_srcdir:-$(dirname "$0")/..}
TESTDIR=${abs_top_testdir:-$(dirname "$0")}
# We need to be able to find swtpm_setup.py and swtpm_setup.py needs to find swtpm
export PYTHONPATH=${TOPBUILD}/src/swtpm_setup
PATH=${TOPBUILD}/src/swtpm:$PATH
SWTPM_SETUP=${TOPBUILD}/src/swtpm_setup/swtpm_setup
SWTPM_LOCALCA=${TOPSRC}/samples/swtpm-localca
SWTPM_LOCALCA=${TOPBUILD}/samples/swtpm-localca
SWTPM=${TOPBUILD}/src/swtpm/swtpm
SWTPM_IOCTL=${TOPBUILD}/src/swtpm_ioctl/swtpm_ioctl
workdir=$(mktemp -d "/tmp/path with spaces.XXXXXX")
@ -26,12 +29,6 @@ function cleanup()
rm -rf "${workdir}"
}
# Quirk for Cygwin
if [[ "$(uname -s)" =~ ^CYGWIN ]]; then
# quirk for CYGWIN where the swtpm_setup executable in is .libs/
cp ${SWTPM_SETUP}.sh $(dirname ${SWTPM_SETUP})/.libs
fi
# We want swtpm_cert to use the local CA and see that the
# local CA script automatically creates a signingkey and
# self-signed certificate
@ -79,7 +76,6 @@ for keysize in $(echo $keysizes); do
--config "${workdir}/swtpm_setup.conf" \
--logfile "${workdir}/logfile" \
--tpm "${SWTPM} socket ${SWTPM_TEST_SECCOMP_OPT}" \
--swtpm_ioctl "${SWTPM_IOCTL}" \
--rsa-keysize ${keysize} \
--overwrite
@ -120,7 +116,6 @@ $SWTPM_SETUP \
--config "${workdir}/swtpm_setup.conf" \
--logfile "${workdir}/logfile" \
--tpm "${SWTPM} socket ${SWTPM_TEST_SECCOMP_OPT}" \
--swtpm_ioctl "${SWTPM_IOCTL}" \
--overwrite
if [ $? -ne 0 ]; then