systemd/0538-tpm2-add-tpm2_load.patch
Jan Macku e5f65c3fc6 systemd-252-27
Resolves: RHEL-1086,RHEL-11591,RHEL-16182,RHEL-19483,RHEL-7026
2024-02-15 09:36:23 +01:00

106 lines
3.9 KiB
Diff

From 82561d585aa6d081fa5f9810f97664526726408e Mon Sep 17 00:00:00 2001
From: Dan Streetman <ddstreet@ieee.org>
Date: Mon, 19 Dec 2022 08:26:32 -0500
Subject: [PATCH] tpm2: add tpm2_load()
This function allows loading an object (e.g. a sealed secret) or key into the
TPM.
(cherry picked from commit d1d0de735da52a7cf5aa5638b07d5fdf4e8b23f2)
Related: RHEL-16182
---
src/shared/tpm2-util.c | 69 +++++++++++++++++++++++++++---------------
1 file changed, 45 insertions(+), 24 deletions(-)
diff --git a/src/shared/tpm2-util.c b/src/shared/tpm2-util.c
index fb75f105e5..6eb37a87aa 100644
--- a/src/shared/tpm2-util.c
+++ b/src/shared/tpm2-util.c
@@ -1484,6 +1484,50 @@ static int tpm2_get_policy_digest(
return 0;
}
+static int tpm2_load(
+ Tpm2Context *c,
+ const Tpm2Handle *parent,
+ const Tpm2Handle *session,
+ const TPM2B_PUBLIC *public,
+ const TPM2B_PRIVATE *private,
+ Tpm2Handle **ret_handle) {
+
+ TSS2_RC rc;
+ int r;
+
+ assert(c);
+ assert(public);
+ assert(private);
+ assert(ret_handle);
+
+ log_debug("Loading object into TPM.");
+
+ _cleanup_(tpm2_handle_freep) Tpm2Handle *handle = NULL;
+ r = tpm2_handle_new(c, &handle);
+ if (r < 0)
+ return r;
+
+ rc = sym_Esys_Load(
+ c->esys_context,
+ parent ? parent->esys_handle : ESYS_TR_RH_OWNER,
+ session ? session->esys_handle : ESYS_TR_PASSWORD,
+ ESYS_TR_NONE,
+ ESYS_TR_NONE,
+ private,
+ public,
+ &handle->esys_handle);
+ if (rc == TPM2_RC_LOCKOUT)
+ return log_error_errno(SYNTHETIC_ERRNO(ENOLCK),
+ "TPM2 device is in dictionary attack lockout mode.");
+ if (rc != TSS2_RC_SUCCESS)
+ return log_error_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
+ "Failed to load key into TPM: %s", sym_Tss2_RC_Decode(rc));
+
+ *ret_handle = TAKE_PTR(handle);
+
+ return 0;
+}
+
static int tpm2_pcr_read(
Tpm2Context *c,
const TPML_PCR_SELECTION *pcr_selection,
@@ -3133,33 +3177,10 @@ int tpm2_unseal(const char *device,
* provides protections.
*/
_cleanup_(tpm2_handle_freep) Tpm2Handle *hmac_key = NULL;
- r = tpm2_handle_new(c, &hmac_key);
+ r = tpm2_load(c, primary, NULL, &public, &private, &hmac_key);
if (r < 0)
return r;
- rc = sym_Esys_Load(
- c->esys_context,
- primary->esys_handle,
- ESYS_TR_PASSWORD,
- ESYS_TR_NONE,
- ESYS_TR_NONE,
- &private,
- &public,
- &hmac_key->esys_handle);
- if (rc != TSS2_RC_SUCCESS) {
- /* If we're in dictionary attack lockout mode, we should see a lockout error here, which we
- * need to translate for the caller. */
- if (rc == TPM2_RC_LOCKOUT)
- return log_error_errno(
- SYNTHETIC_ERRNO(ENOLCK),
- "TPM2 device is in dictionary attack lockout mode.");
- else
- return log_error_errno(
- SYNTHETIC_ERRNO(ENOTRECOVERABLE),
- "Failed to load HMAC key in TPM: %s",
- sym_Tss2_RC_Decode(rc));
- }
-
TPM2B_PUBLIC pubkey_tpm2, *authorize_key = NULL;
_cleanup_free_ void *fp = NULL;
size_t fp_size = 0;