With swtpm now requiring libtpms >= 0.10 some of the patches applied to
the IBM TSS2 test suite have become obsolete. Remove them but also
have swtpm use the default-v1 profile that enables some of the newer
commands that were previously disabled.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
If the user did not provide the profile on the command line read the
default profile from the swtpm_setup.conf configuration file.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Add support for --print-profiles option to print all profiles supported
by libtpms.
Usage:
swtpm socket --tpm2 --print-profiles | jq
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Add a test case for testing profiles across libtpms versions. For now only
an instance with the NULL profile is being tested with the latest libtpms
version and the state is then attempted to be used by libtpms v0.9.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Print a list of names of profiles implemented by libtpms as part of the
capabilities JSON. The profiles map will only be visible if libtpms v0.10
with the TPMLIB_SetProfile() API is used.
swtpm_setup --print-capabilities --tpm2 | jq
{
"type": "swtpm_setup",
"features": [
[...]
],
"profiles": [
"default-v1",
"null",
"custom"
],
"version": "0.10.0"
}
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Print a list of names of profiles implemented by libtpms as part of the
capabilities JSON. The profiles map will only be visible if libtpms v0.10
with the TPMLIB_SetProfile() API is used.
swtpm socket --print-capabilities --tpm2| jq
{
"type": "swtpm",
"features": [
[...]
],
"profiles": {
"names": [
"default-v1",
"null",
"custom"
],
...
},
"version": "0.10.0"
}
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Display the new capability verb 'cmdarg-profile' indicating that the
--profile option with the name= and profile= parameters is supported.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Add support for the --profile option for a TPM 2. The 'name=' parameter
allows a user to select a specific profile available in libtpms. The
'profile=' parameter allows a user to pass a JSON profile that must
contain a name field with a profile known to libtpms. It may contain
an algorithm field that has a comma-separated list of verbs with the
names of algorithms that the TPM 2 is supposed to provide.
The --profile option only has an effect the first time a TPM 2 is started
since afterwards whenever the state of the TPM 2 is read, the profile
found in the state is being used.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Allow passing a JSON map as part of an option value in the format of
--foo name={...},... Prior to this patch this would not have worked since
the option values were broken apart around commas, which a map may also
contain. Now, if a '{' is following the '=', the value is attempted to be
parsed as a JSON map and the end of the map is searched considering
possibly embedded maps.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Libtpms v0.10 adds the TPMLIB_SetProfile call that swtpm needs to set a
profile. Check whether the API call is available in the local libtpms
installation.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
It is better to have it as separate action.
So it can grow with nore thiungs to do on release.
It calls existing docker build and push to avoid duplication.
Signed-off-by: Boris Glimcher <Boris.Glimcher@emc.com>
Auto testing as well as good example on:
how to run SWTPM in docker or compose.
Simply run `docker-compose up` to bring both swtpm and test.
Or run `docker-compose up --build --force-recreate` to re-build.
Or run `docker-compose up swtpm` to only start swtpm service without
test.
Added new job in the github action to automate this as well.
Signed-off-by: Boris Glimcher <Boris.Glimcher@emc.com>
Fixes#869
Using popular Hadolint linter for dockers.
Using standard GitHub action for building.
Build will also publish to GHCR after PR is merged, not before.
Signed-off-by: Boris Glimcher <Boris.Glimcher@emc.com>
Fixed#869
Used multi-stage build here to reduce final image size.
Builder should have packages for dev and compile.
Final image should only have dependencies for runtime.
Building is simple using `docker build .` command.
Or `docker build --build-arg="LIBTPMS_BRANCH=v0.9.6" .`
if you want another branch/tag of libtpms.
Next patch will add:
- linter
- build
- tpm2 tools testing
Signed-off-by: Boris Glimcher <Boris.Glimcher@emc.com>
If the user did not provide the RSA keysize to use try to read it from
setup_setup.conf and if nothing is found there fall back to using the
internal default RSA keysize (2048).
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Factor-out read_file_lines from get_default_pcr_banks and pass the array
of lines from the config file into get_default_pcr_banks now. Now other
functions will also be able to access the lines from the config file
without having to re-read the config file.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Replace usage of samples/swtpm_setup.conf, use the one from tests/
instead. This allows installed-tests to refer to it.
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
swtpm sometimes needs to create lock files in subdirectories of
/var/lib/libvirt/swtpm/. Since libvirt sets the owner of these
subdirectories to root, apparmor blocks swtpm's access to this when set to
owner. Add write permissions for lock files without the owner restriction
tothe folder to fix wc denials.
Signed-off-by: Lena Voytek <lena.voytek@canonical.com>
Some features of swtpm require kernel modules, such as --vtpm-proxy. Fix
apparmor denials related to this by adding capability sys_admin to the apparmor
profile.
Signed-off-by: Lena Voytek <lena.voytek@canonical.com>
Older versions of libtpms produced smaller initial state files.
Therefore, use a regular expression to compare the sizes.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Since swtpm does not use concurrency while writing state files, set
the process umask to 0 when the state file is created or truncated for
writing and the user requested specific mode bits. This avoids an
additional syscall in the possibly timing critical path when processing
a TPM command and having to write the state.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
The mode bits that the user provided were only applied with open() and were
subject to masking with the value of current umask. When umask was set to
0027 the test case test_commandline was failing because the mode bits on
the create TPM state file were not the expected ones (masked by umask).
Therefore, set the mode bits using fchmod if the user provided them,
otherwise do not set them. This way the mode bits will be set to the values
the user requested.
Currently the directory storage backend was setting the mode bits to the
default value (0640) *after* opening the TPM state file. Now, if the user
did not provide any mode bits then the mode bits will be set so that the
file can be written to as owner. This ensures that at least mode bits 0600
are set by default. However, if the user provided mode bit flags then these
will be used without modification.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Replace mkstemp with g_mkstemp_full and pass parameters that lead to
the same mode bits and file opening flags and mkstemp had. This addresses
a Coverity complaint regarding missing application of umask before
mkstemp.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
swtpm <0.8 tried to lock the .lock file when executing --print-states,
which then failed when another swtpm was holding the lock. This adds
a test case for this scenario.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Due to a significant change in the targeted SELinux policy re-develop
the SELinux policy for swtpm. New rules in swtpm_libvirt.te are needed
when libvirt causes new interactions between swtpm and other types.
Also consider extensions to the SELinux policy previously added due to
domain XML and command lines described in the following patches:
- 63825b296c
- 7dac1dbf6f
Also:
- add rules related to user_tmp_t are due to the following paths being used
in session mode: /run/user/*/libvirt/qemu/run/swtpm
- add rules for swtpm_t accessing qemu_var_run_t file/dir/sockfile
- add rules for swtpm_localca (newly installed F40 system) needed once when
/var/lib/swtpm-localca is empty and files there are created
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Coverity is complaining that thread_busy needs to be locked before
reading. For consistency reasons now also lock thread_busy before reading
it. However, in this case it does not make a difference whether this lock
is held when reading thread_busy since file_ops_lock is held when the
thread_busy flag is set and when it is read with a call to this function
(worker_thread_is_busy). Also while the thread is busy no further commands
can be submitted and it can then reset the thread_busy flag without holding
the file_ops_lock.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Coverity is complaining that ptm_response in the worker_thread needs to
be locked via the file_ops_lock since it is always locked when
ptm_response is accessed. However, once the thread has been started any
concurrent modification of the ptm_response is prevented with the
thread_busy flag. Therefore, add comments to the thread and ptm_reponse
variable about the locking.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Even though concurrency is not possible before ptm_cuse_lowlevel_main
is called lock the file_ops_lock since Coverity is complaining that
- g_lastCommand in ptm_send_startup
- ptm_repsonse in ptm_send_startup
- tpm_running in main
are not locked. For consistency reasons now also lock these variables
even before activation of concurrency.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Lock the file_ops_lock before reading the tpm_running variable so that
access to access to it is serialized among all possible threads.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Add support for --disable-tests to disable the tests and the checking
for tools that only need to be installed for the tests. Keep the tests
enabled as default as it was before.
Resolves: https://github.com/stefanberger/swtpm/issues/843
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
