PCR policy authmodel, continuation of #833 - #916
Conversation
This makes it easier to add new vendor attributes without accidentally reusing the same constant value and making implementations incompatible. Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>
To be used as a storage of TPM policy in JSON formed understood by tpm2-tss libpolicy library. Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>
Policies are expected to be specified in JSON format. The command allows reading, writing or deleting policy set on an object. Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>
To specify the policy right on creation. Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>
It was added in tpm2-tss v4.0 and functionality that requires it will be no-op when it's not there or --without-policy is specified during configuration step. Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>
If tpm2-pkcs11 was built without tss2-policy, policy is ignored (a warning is logged about it). This might work for other kinds of policies if they don't require any callbacks for calculation or execution of a policy. Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>
Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>
It said "add" instead of "export". Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>
It's --with/without-fapi (or --with-fapi=yes/no). Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>
It's a calculation callback, but not yet calculated policy is automatically calculated before execution. Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>
Signed-off-by: Anton Lundin <glance@ac2.se>
This reworks the policy code into something that actually validates the policy, and adds a test for it. Signed-off-by: Anton Lundin <glance@ac2.se> Assisted-by: gemini-cli:gemini-3-flash-preview
|
I now see that the quite complicated github actions tests looks to not have libtss2-policy . If you'd like to see the test run, I can probably add that. I've run the tests locally on my debian trixie machine, against the system libtss2-* and it works just fine. That's my indented target to run this on to, so I'm quite happy that I don't need to locally build the whole tpm2-software stack and can just build tpm2-pkcs11 for now. |
|
I've written a patch, replacing the shellout to tpm2_createpolicy in calculate_policy_digest with calls to tpm2_pytss TPM2_policy , but I'm uncertain in how to treat the tpm2_pytss interactions in tpm2-pkcs11. Is tpm2_pytss a optional dependency for tpm2_ptool or not? tools/tpm2_pkcs11/tpm2.py just does shellouts. Now when thinking about it, calculate_policy_digest should probably be moved to tools/tpm2_pkcs11/tpm2.py anyhow. |
|
Interesting, I need to test whether this addresses my needs for |
|
Feel free to. This code needs testing. glance-@4ecc139 contains code for more generic policy stuff rather than the current shellout to tpm2_createpolicy . I'm still thinking about replacing some/most/most of the shellouts to tpm2-tools with tpm2_pytss FFI calls, of which that is a first step. |
3 participants
This is work based upon #833 , and those commits are just rebased on top of current master.
I've tested this a bit and it looks like the policy is actually in effect now.