Allows virtqemud_t to:
- Signal and control swtpm_t processes (noatsecure, rlimitinh, siginh, signull, setsched)
- Create and listen on Unix stream sockets with swtpm_t processes
This enables libvirt to properly control swtpm instances,
including sending signals and managing process scheduling attributes,
when the system is using cockpit-machines interface to manage and start VMs.
Fixes: https://github.com/stefanberger/swtpm/issues/1131
Signed-off-by: JMarcosHP <jehuherrerap@hotmail.com>
Since Ubuntu-26.04 does not have an IBMTSS2 package anymore, prepare the
tests to build the tss tools from the sources when needed.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Using the kernel name was not a good choice for determining which flavor
(BSD vs. GNU) of stat, sed, and install was being used since one could
install either one of them at least on MacOS. Instead, check whether
--help is supported by these tools.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
The (unsigned char[SCHEMEDATA_SIZE]) casts are not necessary for the
initialization of the schemedata byte arrays and clang does not accept
them. Therefore, remove them.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Remove the SOCK_CLOEXEC flag from the socket call since it is not necessary
(no fork+execve will be run with it) and per user-report may not compile on
Darwin.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
To query for the buffer size, use the TPMPROP_TPM2_BUFFER_MAX when
using a TPM 2. This is a new property introduced in libtpms v0.11.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
swtpm_localca and swtpm-create-tpmca now depend on openssl command line
tool, so add it as a dependency for the swtpm-tools and
swtpm-tools-pkcs11 packages.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Remove the checks for GnuTLS and certtool from the build system now that
certtool is not used anymore.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Remove the dependency on the gnutls utilities package where possible.
swtpm_localca does not need certtool anymore but sample/swtpm-create-tpmca
still needs p11tool from gnutls-utils.
rpm:
- tools-pkcs11 may keep the dependency due to dependency on p11tool
debian:
- swtpm-create-tpmca is not packaged
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Rather than keeping gnutls-utils/gnutls-bin as a hard dependency, have
test cases check for for availability of p11tool and skip the tests if
the tool cannot be found.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Since TPM 1.2 tcsd is not available anymore, have_tcsd will always be 'no'.
Remove all the code around have_tcsd.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Older versions of swtpm require the expect package to be installed, but we
do not need it anymore and will get rid of it. Pass --disable-tests when
building older versions of swtpm to avoid the older build scripts to check
whether 'expect' is installed -- which may not be the case anymore.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Since certtool is not used anymore by swtpm_localca, remove the paragraph
related to it from the man page.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Use openssl CLI tool now for creating the local root and intermediate CAs.
Create the CAs with an RSA-3072 key for as long as OpenSSL >= v3.5 is not
required.
Adjust one test case to have a longer password since openssl requirew at
least 4 characters for a key password.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Extend an existing test case using the IBM TSS2 tools and add state created
with libtpms v0.9 and v0.10 that contains signing and encryption primary
keys. Use the keys to verify a signature created by those versions of
libtpms and data encrypted by them to make sure that primary keys that are
recreated with later versions of libtpms still create the same primary
keys.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Create the IAK hwSerialNum from the authority key identifier (AKID) and
serial number extracted from the EK certificate.
Adjust a test script that now needs to use a valid certificate for the EK
so that we can get the AKID and serial from it to create the serial number
for the IAK certificate.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Extend swtpm_setup to create IAK and IDevID keys and certificates using
command line options --iakkeyalgo and --idevidkeyalgo to choose the
key algorithms for those types of keys.
Use the same CA for signing the IAK and IDevID certificates as used for
the EK and platform certificates since all these certificates are issued
at the same time anyway.
Persist IDevID and IAK keys at 0x81020000 and 0x81020001 respectively.
Add documentation to the man page.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Prepare for primary EC keys for IAK and IDevID to be created with 2
different nonce (one containing the unique string, the other being empty).
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Move the ECC SPK offsets where the public key can be found in the response
into the table along with the keyflags for SPKs. Also move the SPK RSA
parameters into this same table.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Add support for the --tpm-serial-num command line option to pass it on to
swtpm_cert.
Make the vmid part of the serialNumber of the subject passed to
swtpm_cert (following an email exchange with TCG IWG).
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
swtpm_localca will pass the serialNumber in the subject command line option
and we can use this rather than the TPM serial number.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Have the test_tpm2_swtpm_setup_check_certs use the default-v1 profile for now
to be compatible with libtpms v0.10 while libtpms v0.11 is not required, yet.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Add support for certificate types iak and idevid. Both require the new
command line option --tpm-serial-num to be passed.
Add support for creating the ASN.1 for the SAN for the new certificates.
Advertise the support for the new certificate types using the capabilities
JSON with entries "cmdarg-tpm-serial-num" and "supports-iak-idevid".
Add documentation to the man page and extend test cases.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
For the conversion to openssl CLI tool, add openssl and pkcs11-provider
as build dependencies so that tests can run.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Add a test case that creates various types of EKs and compares them against
the (public) keys created by tpm2_createek, if the tool is found to be
available and the swtpm tcti is installed and the tools knows how to create
the type of key. Any failure by tpm2_createek to create a key leads to no
comarison of the keys being done.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
ecc_nist_p384 is a name that the Intel TSS2 tools are using for command
line option. Add secp384r1 as an alternative for it.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Remove support for parentkey_password for TPM 1.2 SRK since swtpm_cert
does not support it anymore.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Introduce a 'keychoice' variable and set it when the user provides an
option for a particular type of key, such as the modulus or exponent for an
RSA key or the x and y parameters for an EC key. Check that no conflicting
parameters are provided.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
