Do not bother trying to keep pidfilefd open in case fd = pidfilefd,
but close it unconditionally. If writing the pidfile fails, the process
terminates anyway, besides that we only ever need to write to the
pidfile once, which is happening in this function.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
This patch fixes the following compilation issue/bug:
ctrlchannel.c: In function ‘ctrlchannel_process_fd’:
ctrlchannel.c:694:13: error: array subscript ‘ptm_hdata[0]’ is partly outside array bounds of ‘struct output[1]’ [-Werror=array-bounds]
694 | data->u.resp.tpm_result = htobe32(res);
| ^~
ctrlchannel.c:486:7: note: while referencing ‘output’
486 | } output;
| ^~~~~~
Sending hashes to the TPM is not currently used in any major
application, so this bug should not affect much.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Older ARM processors need more time to create the initial CA keys
and then the key for the TPM. So we increase the timeout to 30s.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
This patch addresses CVE-2020-28407.
Use the open() call rather than the fopen() call when accessing
the statefile and make sure we do not follow symlinks using O_NOFOLLOW.
The modification does not allow an attacker to create a symbolic link
with the name of the temporary file (TMP2-00.permall for TPM 2) and
have this point to a valueable file and swtpm ends up overwriting the
file. The success of the attack depends on the attacker having access
to the TPM's state directory (--tpmstate dir=...).
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
This patch addresses CVE-2020-28407.
Use the open() call rather than the fopen() call when creating a pidfile.
Also prevent us from following symbolic links when opening the pidfile for
writing.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
This patch addresses CVE-2020-28407.
Prevent us from following symliks when we open the lockfile
for writing.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Lift the code that sets up the vtpm proxy device out of the main
function and put it into its own function.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
To force the installation of the python programs add a python-install
target. This solves an installation issue with non-standard prefix,
like not using /usr or /usr/local, as may be the case on OS X (Apple)
when using homebrew. It leaves the 'make distcheck' working, which also
uses a non-standard prefix and where we don't want to install the tools
due to issues with removing them afterwards where pip3 cannot be used.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
To support writing state files atomically we first write into
a temporary file and then rename it.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
To avoid clashes with libtpms print functions, prefix the print function
in swtpm with SWTPM_ rather than TPM_. This may matter on older systems
where libtpms could call into swtpm's TPM_PrintAll function due to it
having the same name as libtpms's function.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
During the rewrite the additonal "/.config/" got dropped from the
path when using ${HOME} for locating he default config file.
Re-add it.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Distributions often have their own guidelines regarding installation of Python
modules (e.g. Arch Linux mandates using --optimize=1 for setup.py install,
which the Makefile in this project does not do). Add an option
"--disable-python-installation" (disabled by default) to allow skipping the
Python installation process entirely so that distributions can take care of
this process manually in their preferred way.
Signed-off-by: Jonas Witschel <diabonas@archlinux.org>
Clang complains if eiher one of those linker flags are used during compilation:
clang-9: error: -Wl,-z,relro: 'linker' input unused [-Werror,-Wunused-command-line-argument]
clang-9: error: -Wl,-z,now: 'linker' input unused [-Werror,-Wunused-command-line-argument]
This patch applies those flags only when linking.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Get rid of the 'c' code that only changed the user and add for support of
the --runas option to change to a different user in the python part.
To get 'make distcheck' to work I needed to name the swtpm_setup python
script with the suffix .in so that it gets copied to the build directory
as swtpm_setup. We need to change execute permissions on this file after
copying.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Switch over to the new python implementation of swtpm_setup. We need to
also adjust test cases that involved the tcsd that otherwise fail for
various reasons. For in-place testing we need to adjust the PYTHONPATH
and PATH so that swtpm_setup.py can be found and so that swtpm_setup.py
then finds swtpm if it is not explicitly passed as parameter.
Adjust the man page for swtpm_setup to reflect the changes.
We now can run swtpm_setup as any user. However, libvirt still runs it
as tss:tss (for example), which is then creating the signing key as tss:tss
as well. Ideally libvirt would run it as tss:root or any other combination
since the tss group may be used for user wanting to access /dev/tpmrm0 for
example. We at least change the directory ownership of /var/lib/swtpm-localca
to tss:root and keep the world out of this directory.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Rewrite swtpm_setup.sh in python. Use a permanent connection from the
tool to swtpm via passing file descriptors of a unix socketpair. Implement
all functionality in python so that we don't rely on trousers and tpm-tools
for swtpm_setup. This now allows any user to setup a TPM 1.2 whereas before
it had to be root or the tss user.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
BSD's sed does not print \n as newline, so we have to split the string
into different lines using tr.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Add build targets selinux-install and selinux-uninstall to install
and uninstall the SELinux policy rules at a given priority. The
priority defeaults to 400, which works fine on Fedora.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Get rid of using eval when calling $create_certs_tool and only use
eval for resolving variables from the config file.
We only want variable substitution for entries from configuration
files, so escape all other special shell characters that may be
making it onto the command line so that no subshells are opened
and no redirection to files can occurr.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Change the file and directory ownership of tcsd related files only if it
is absolutely needed. It is not needed if we are running as user TCSD_USER
in group TCSD_GROUP because then the files were created with the needed
owner and group. This avoids problems when trying to change file ownership
when invoked by libvirt where we do not have the capabilities to change
file ownership even as root.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
When the TSS_USER != TSS_GROUP, e.g., user 'root' and group 'tss', then
tcsd requires that the access mode bits on the $TCSD_CONFIG file are set
to 0640, otherwise we get this error:
TCSD ERROR: TCSD config file (/tmp/tmp.Yd4LIF7mCE) must be mode 0640
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Redirect stdout and stderr from tcsd into a file and if tcsd reported
an error copy the error into the logfile. This makes debugging tcsd
related issues, such as ownership or access mode issues, easier.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
This patch fixes the following linker issue reported for Gentoo in
issue #280.
ld.lld: error: /var/tmp/portage/app-crypt/swtpm-0.3.1-r1/work/swtpm-0.3.1/src/swtpm/.libs/libswtpm_libtpms.so: undefined reference to EVP_sha512
ld.lld: error: /var/tmp/portage/app-crypt/swtpm-0.3.1-r1/work/swtpm-0.3.1/src/swtpm/.libs/libswtpm_libtpms.so: undefined reference to PKCS5_PBKDF2_HMAC
ld.lld: error: /var/tmp/portage/app-crypt/swtpm-0.3.1-r1/work/swtpm-0.3.1/src/swtpm/.libs/libswtpm_libtpms.so: undefined reference to SHA512
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Extend the --print-capabilities option to also report supported RSA
key sizes. Only the TPM 2 may support anything else than 2048 bit RSA
keys, so we only consult 'swtpm socket --tpm2 --print-capabilities'
and grep for 2048 and 3072 key sizes and report them.
If nothing is found, nothing is reported, as before, and 2048 bit RSA
keys should be assumed.
'swtpm_setup --tpm2 --print-capabilities' may now show the following:
{
"type": "swtpm_setup",
"features": [
"cmdarg-keyfile-fd",
"cmdarg-pwdfile-fd",
"tpm2-rsa-keysize-2048",
"tpm2-rsa-keysize-3072"
]
}
Also adjust a test case to use a regular expression for matching
against an expected string that may nor may not have rsa-keysize
verbs.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Construct RSA key size capability strings from libtpms TPMLIB_GetInfo()
string so that we can easily show which RSA key sizes are supported by
the TPM 2 implementation. If none are advertised, 1024 & 2048 can be
assumed to be supported.
'swtpm socket --tpm2 --print-capabilities' may now print the following:
{
"type": "swtpm",
"features": [
"tpm-send-command-header",
"flags-opt-startup",
"cmdarg-seccomp",
"cmdarg-key-fd",
"cmdarg-pwd-fd",
"no-tpm12-tools",
"rsa-keysize-1024",
"rsa-keysize-2048",
"rsa-keysize-3072"
]
}
We need to adapt the related test case to use a regular expression since
the rsa-keysize-xyz strings may or may not be there depending on libtpms
version.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
If the host is missing tcsd (trousers) or the tpm-tools, swtpm_setup
will now report the 'no-tpm12-tools' verb like this:
> swtpm_setup --print-capabilities | jq
{
"type": "swtpm_setup",
"features": [
"cmdarg-keyfile-fd",
"cmdarg-pwdfile-fd",
"no-tpm12-tools"
]
}
The only TPM 1.2 setup parameter that requires interaction with
the TPM 1.2 that can be pass is then '--createek'.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
The ECC storage primary key was mistakently created in the endorsement
hierarchy but should be in the owner hierarchy. This patch corrects this
to have this key created in the owner hierarchy (like the RSA key),
thus using 0x40 00 00 01.
This only mattered if one used --create-spk and --ecc together.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Return the result of the called function rather than 0.
Fixes: d65f5ae1 ("swtpm_setup: Create RSA 2048 and ECC NIST P256 keys and certs")
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Remove tpm2_stirrandom, which we should not need to run on a newly
created TPM 2.
Also remove tpm2_changeeps which was called twice when creating two
EKs, thus invalidating a previous EK that may have been created.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Switch to NIST P384 curves for the storage primary key as well as the 2nd EK.
The EK part now complies with the following specification:
TCG PC Client Platform TPM Profile Specification for TPM 2.0
Version 1.04
Revision 37
February 3, 2020
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Following "TCG PC Client Platform TPM Profile Specification for
TPM 2.0, version 1.04, Rev 37" create and RSA and an ECC NIST P256
key now. We will upgrade the ECC NIST key to P384 in the next
step.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Pass the ECC curve id and hash algorithm and the ECC_NONCE to the
function creating the ECC keys rather than hard coding them. Rename
the functions that create the NIST_P256 ECC keys to have _nist_p256
suffix in the name.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Rather than passing the offset of the 2nd part of an ecc key pass
the length of the key and calculate the 2nd offset using the length.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Leave a not about what version of template was used for the
RSA and ECC EK keys before updating them now.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Implement support for passing the curve id via the --curve-id
option. Default assumes secp256r1. secp384r1 is also supported.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Handle the default cases, which shouldn't ever be reachable, and set
the tocopy to '0' so that no unitialized variable gets copied.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
It's not necessary anymore to #include <seccomp.h> from the main programs.
Once removed, it also fixes the build on SuSE where seccomp.h is in
seccomp/seccomp.h and we didn't use the LIBSECCOMP_CFLAGS for swtpm.c etc.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Compilation on cygwin reports the following issue:
In file included from key.c:43:
key.c: In function ‘key_stream_to_bin’:
key.c:135:26: error: array subscript has type ‘char’ [-Werror=char-subscripts]
135 | !isspace(input[digits]) &&
| ~~~~~^~~~~~~~
key.c:143:40: error: array subscript has type ‘char’ [-Werror=char-subscripts]
143 | if (input[digits] && !isspace(input[digits]))
| ~~~~~^~~~~~~~
Address the issue using an explicit cast of char to int.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Remove some commented code and some code that isn't executed any
differently for the user id that's running it.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
To make swtpm_setup.sh work on Travis on Bionic we need to
explicitly set TCSD_TCP_DEVICE_HOSTAME=127.0.0.1 since lookup
of localhost (with the API the tcsd is using) does not work.
It doesn't negatively affect any other use case, so no problem
setting it.
Also replace localhost in the bash tcp device path with 127.0.0.1.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
'swtpm chardev --vptm-proxy' currently requires a '--flag startup-xyz'
to be passed since otherwise the need_init_cmd variable would not be
set to false and swtpm would terminate after sending the startup
command. To maintain backwards compatibility we have to always
set the need_init_cmd variable to false for the --vtpm-proxy case
and must not require a startup flag to be passed.
Roll back one of the test case to not use the startup flag.
Fixes: e6bc4bdf0 ('swtpm: Enable sending startup commands ...')
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
The vtpm proxy device requires that the TPM be 'Startup' otherwise it
fails sending the first command to it and will send the 'Startup'
(SU_CLEAR/TPM_ST_CLEAR) itself while adding a log entry. We want to
avoid the kernel log entry.
Add options to the existing --flags option that allows one to start
up the TPM 1.2 or TPM 2.0 with the startup types 'clear', 'state'
and 'deactivate' (TPM 1.2 only). Extend the --print-capabilities to
advertise the availability of these options with the string
'flags-opt-startup'.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Add support for the --print-capabilities option to display newly
added capabilities. Adpat the man page and related test case.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Allow passing signing key and parent key via files and file descriptors
and environment variables. Adapt a test case to exercise this new
functionality.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
This patch addresses several issues found with shellcheck. In particular
it now enables variables with spaces in them, such as file paths that
contain spaces.
Adjust one of the accompanying test cases to use spaces in the path.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Block the SIGPIPE so that a failing write() can return an EPIPE
rather than killing the process with a SIGPIPE.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Block the SIGPIPE so that a failing write() can return an EPIPE
rather than killing the process with a SIGPIPE.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Only accept new client connection on the control channel if we
currently do not have a client on the control channel.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
swtpm_setup will fail once libtpms starts supporting other PCR
hash banks than sha1, sha256, sha384, sha512, and sm3-256. So,
this patch allows to choose active PCR banks of the SHA3 series.
Further, unknown hash banks will not fail the tool anymore when
it tries to determine which hash banks are supported by the TPM
since it will then add the hex number of the hash algorithm to
the collection of supported hashes.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Search for the SWTPM_EXE / SWTPM_IOCTL executable using 'type -P' to
determine whether it is an executable rather than assuming a full path
is given on which we can check -x.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
swtpm_setup.sh uses file descriptor 100 for 'exec 100 <> ...'.
So we have to make sure that the file descriptor inherited from
the caller of swtpm_setup does not overlap with a reserved range
to be used by swtpm_setup.sh, which we declare to be [100..109].
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Fix a cut and paste error in the error message output and be more
verbose in log about encryption when using file descriptors.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
The --print-capabilities is missing in the 'swtpm chardev' help screen
but the code is there to interpret the command line flag. This patch
adds the missing lines to the help screen.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Use the gnutls_x509_crt_get_subject_key_id() API call to get the subject
key ID of the signer's certificate rather than gnutls_x509_crt_get_key_id().
The latter returns the same result most of the time but there are instances
when this is not the case and the returned result is wrong.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
The OIDs for the TPM 1.2 and TPM 2 platform data
are different (though have the same name in the spec).
Adapt them for the TPM 2 case.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
We have to use writev_full() when --vtpm-proxy is used since writev()
does not seem to work and we get an EIO error. writev_full() uses write(),
so we can use it.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Implement read_eintr() to read into a buffer and handle EINTR on
the way.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Implement write_full and writev_full that handle partial writes.
Implement writev_full using write_full since handling partial writes
with iovec's can become quite complicated.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Extend swtpm_setup with the --print-capabilities option which
prints a JSON object describing supported features.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
rm on NetBsd prints out an error message when trying to remove a file
with an empty filename. Avoid this situation by checking for non-empty
filenames first.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Implement support for printing newly added capabilities, such as
being able to read the key and password from a file descriptor.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Stub out the handle_seccomp_options function and other unused
code and data if WITH_SECCOMP is not defined.
Currently the handle_seccomp_options would always be called with
a NULL string to parse if WITH_SECCOMP is not defined, so this just
eliminates the code that will never be called.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Have swtpm report PTM_CAP_SEND_COMMAND_HEADER flag for a TPM 2
indicating that it knows how to handle the TCG header prefix
for the data channel.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Add support for handling the TPM 2 command header prefix that looks like this:
struct tpm2_send_command_prefix {
uint32_t cmd;
uint8_t locality;
uint32_t size;
};
This patch converts the existing send function to use an array of struct iovec
using writev() where we can optinally prepend a response header and trailer.
We detect whether the command had the above type of header prefixed and if so
indicate this with an offset into the byte stream where the normal TPM command
starts, which follows right after this header. In case such a header was found
we prepend a header in the response and append a 4-byte trailer. For TPM 1.2
there are no changes and for raw TPM 2 commands there are no changes, either.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Have SWTPM_IO_Read() read at leat the 10 bytes from the (regular) TPM
header. This solves a particular problem with the TPM 2 header prefix for
which we will add support in the subsequent patch. In the prefix case the IBM
TSS 2 stack sends 4 bytes for the command, then 1 byte for the locality, and then
4 bytes for the length indicator followed by the command. If we just read once
we would only then get 4 bytes. Reading 10 bytes gets all of these plus the sub-
sequent TPM command or the whole TPM command in case this prefix header is
missing.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Now that we will always read all bytes available on a file descriptor
we don't need the MAINLOOP_READALL flag anymore.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Since we can only read the file descriptor for the passphrase once,
we cannot stop the TPM 1.2 and then restart it but we have to use
'swtpm_ioctl -i' to re-init it.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Also extend swtpm_setup to allow passing the file descriptor for
the key or password files or pipes.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Enable reading the password file from a file descriptor using
--key pwdfd=<fd>
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Get rid of stat() so that we can read from pipes as well.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
filelen is the length of the file as it was stat'ed. len is
the number of bytes read. They should be the same. So, use
len as a parameter to SHA512() rather than filelen.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Enable reading the state encryption or migration keys using a
file descriptor passed via the command line option parameter.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Consolidate the exist of the parse_key_options function.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Add missing kdf option documentation to help screen. The kdf
option parameter support has been there since 0.1.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
The CUSE TPM needs the prctl syscall to function correctly when
commands are passed via the thread pool.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Fix an illegal heap access while parsing the options by making
sure that we do not access the tok variable beyond its size
when comparing a character to '=' and later on when accessing
the value after the '='.
This bug was discovered by configuring as follows on Fedora 28:
CFLAGS="-fsanitize=address -g -ggdb" LIBS="-lasan" \
./configure --prefix=/usr
and running tests like this:
sudo bash -c "SWTPM_TEST_EXPENSIVE=1 make -j32 check"
The test case test_tpm2_ctrlchannel2 indicated the error.
It looks like gcc on Ubuntu Xenial on Travis did not detect this
error.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Extend the previously modified test case to also test on
Darwin now that we are able to convert a file descriptor
to a filename.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Enable support for the seccomp blacklist profile that is
enabled by default and can be disabled using the following option:
--seccomp action=none
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
According to the XDG spec,
https://specifications.freedesktop.org/basedir-spec/basedir-spec-latest.html:
"If $XDG_CONFIG_HOME is either not set or empty, a default equal to
$HOME/.config should be used."
This fixes setting up a TPM with libvirt running in a user session.
It works by checking if configuration files are readable in the
directory priority order (XDG_CONFIG_HOME, then HOME, then SYSCONFDIR).
When libvirt is running as a system instance, $HOME isn't set, so it
will fall back on @SYSCONFDIR@ (/etc usually)
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
To avoid failures with mktemp call on BSD type of systems replace
mktemp --tmpdir=<dir> with TMPDIR=<dir> mktemp, which seems more portable.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
OS X cannot resolve the path we get from genenv("_") when running a
test script on Travis (reason unknown). So we use _NSGetExecutablePath()
instead and display the path in the error message in case realpath()
fails.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
When the project is configured with --prefix=/usr/local several configuration
files are installed to /usr/local/etc but not read by the programs that
need them. This patch fixes this issue by replacing @SYSCONFDIR@ in the source
code of those files with the actual used path.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
For PKCS11 modules (such as SoftHSM) to sign a TPM EK or platform
certificate we use 'pkcs11:' prefixed URIs like those URIs for
TPM 1.2 starting with tpmkey:.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Implement terminate_proc, which first tries to gracefully terminate a
process and then, if synchronization is requested, waits for 1 second
for it to disappear and then kills it with SIGKILL if it didn't go away.
Use this function for stop_tpm and stop_tcsd, which will first try
to send a SIGTERM to a process assuming it will terminate while we
do something else and then, in case the process needs to be restarted,
make sure that it's gone before it is restarted.
This addresses an issue where previously SIGTERM was sent to a process
before it was restarted but the restarting failed due to the previous
process still holding a lock on the file because it wasn't able to react
to the SIGTERM fast enough.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Uninstall the signal handler before we close the signal handler's
notification file descriptor so that signals received after the file
descriptor is closed do not cause an error.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Make sure that the msg parameter passed into recvmsg wasn't modified
by the library and verify that the pointers and sizes it contains are
still valid after the call. This addresses an issue raised by Coverity.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Ceritficates for a TPM 2 have to be signed using SHA256 and those for
a TPM 1.2 have to be signed using SHA1 (following specs). We can use
either of these algorithms when using the GnuTLS TPM support since it
will create the hash and have the TPM 1.2 sign whatever it created.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
swtpm_setup.sh does not need to be owned by tss:tss and in the
Fedora package it's not even allowed. So remove the install hook
that was changing the ownership.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Implement the --tcsp-system-ps-file option to make a backup of
TCSD's system_ps_file for later use of the setup TPM with the
TCSD. We need this for a test case.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Have the CUSE TPM return the TPM start error, particularly
TPM_DECRYPT_ERROR in case a wrong key was passed, rather than the plain
TPM_FAIL error code. This was a difference with the 'other' swtpm
interfaces that already returned the original error code.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Gnutls supports TPM 1.2 keys in its API and we can use a TPM 1.2
signing key for signing the EK or platform certs.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
The crypto functions for AES encryption and decryption clash with crypto
function names of libtpms. Avoid this by prefixing them with SWTPM_ instead
of TPM_.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
This patch adds rules that are needed for running QEMU with libvirt 4.4
on F28. This allows one to test the libvirt management stack and QEMU with
swtpm and SELinux in enforcing mode.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Only when the CUSE TPM is built we need the glib-2.0 dependency
(which can be removed at some point probably).
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
glib2 did not clean up a proxy thread once the pool was torn down. The
reason was that an exclusive pool was used. Switch to a non-exclusive
pool, which will cause the last thread to terminate as well and we have
a clean valgrind log now.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Valgrind complains about uninitialized bytes being accessed by a writev()
call in libfuse. It points to a line in the error branch
'error_not_running', but the error does not seem to come from there.
Instead, if we initialize ptm_est to zeros the problem goes away.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
With the fuse_session now global, we can use it to exit the CUSE
TPM using fuse_session_exit().
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
To be able to get to the low level fuse_session data structure, which
allows us to terminate the program more gracefully than the exit() in
the ioctl processing code, we implement the low level cuse startup code.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
F27 needs an additional rule for starting the swtpm from libvirt.
Add the rule 'allow svirt_t swtpm_exec_t:file map'
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
gcc 4.2.1 does not accept the initializer '= { 0 }' and so we now switch
this to memset as well.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Valgrind complains that there are uninitialized bytes when ioctl() is called.
This is due to the fact that we are passing the structure to the ioctl()
without specifying how many bytes are valid in the passed buffer.
So, we initialize the buffers to 0 and the complaint is resolved.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
When the AES encryption and decryption function were extended to support
256bit keys the size of the user ivec on the stack was also increased to
32 bytes. For the user provided IV we now must only copy 16 bytes in case
an 128 bit key is used. Fix the length parameter to the memcpy().
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Install the private libswtpm_libtpms into $(libdir)/swtpm
rather than into the shared libaries directory.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
To make the RPM building easier for the --without-cuse case we have to omit
a couple of files from being built so that they are not left-overs when
packing the RPM without building swtpm-cuse.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
An out-of-tree build fails to build swtpm_svirt.pp due to missing
source files from the swtpm.pp policy. Add the swtpm.{te,if,fc} files
as dependencies of the swtpm_svirt.pp policy package.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Use .NOTPARALLEL for the SELinux policy build target to avoid running
the rule concurrently and deleting the tmp directory while another
build is running.
For some reason it is not possible to use $(MAKE) since otherwise the
building of the policy package fails.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
This patch is partially from Lukas Vrabec (lvrabec@redhat.com) and fixes
some nits in the SELinux policy.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Extend the SELinux policy with rules for svirt_tcg when
QEMU is not being started with KVM by libvirt.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Coverity scan shows an uninitialized access in case an error is
encountered and the cleanup path is taken before datum was initialized.
Fix the error by initializing the variable.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Coverity scan discovered a buffer overrun error in case the
datum->size = 0. Fix the error.
The function with the potential error is not called if datum->size == 0.
Also make the 'size' variable larger so there cannot be a overrun in
'size = datum->size + sizeof(buffer) - i'.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Implement command line support for choosing the cipher to use for
the TPM state encryption. Either aes-128-cbc or aes-256-cbc can be
used. The same cipher has to be passed on the swtpm command line
when using the TPM.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Use the flags in the header to check the size of the provided key(s) against
the one(s) from the user. There are the state and migration keys, each has
a different flag in the header if a 256bit key was used. We display an error
about the mismatching key size against expected size if the given key is of
the wrong size.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Extend the buffer the key is read into to hold an 256bit key.
Add support for aes-256-cbc. Also, aes-128-cbc is now a synonym for
aes-cbc.
Update the man pages to reflect the AES 128 support.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Enable 256 bit AES keys in the en- and decryption functions.
Set a flag in the header to at least indicate whether 128bit
or 256bit keys were used.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Remove the valid field from the symmtric key structure and
user userKeyLength > 0 instead, which is the same.
Also remove the tag and fill fields, which were originally used in
TPM 1.2.
Use function calls to test whether the file or migration key is
available where possible.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
To get rid of the hard coded AES key size of 128, we add a filed
userKeyLength that describes the length of the key being used.
We replace TPM_AES_BLOCK_SIZE with userKeyLength where possible.
Rename TPM_AES_BLOCK_SIZE to SWTPM_AES_BLOCK_SIZE.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Use pbkdf2 as the default kdf and sha512 for the existing
test case. Do away with file limit of 32 bytes. This may
break backwards compatibility for some but better to do this
before a release...
Switch the existing test cases to use kdf=sha512 on the command
line where necessary to that the state for these test cases
does not need to be recreated.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
On some systems /bin/bash does not exists but the bash is somewhere
else and can be invoked with /usr/bin/env bash.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
The building of rpm files fails due to some issues with the rules. To make
this work we explicily list the policy packages' dependencies and use them
in the rules. This now make 'make distcheck' work and lets us build an RPM.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
For sys_dependencies.h to be found during out-of-tree builds we
need to include -I$(top_srcdir)/include.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
OS/X also does not have a proc filesystem, so we use the '_'
environment variable to determine the path of the program.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
The daemon() call is deprecated on OS X. This patch works around it so
that we can compiled with -Wall -Werror and still can use the daemon()
call while avoiding compiler errors due to this function's deprecation
marking in stdlib.h.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
