121 lines
6.1 KiB
Diff
121 lines
6.1 KiB
Diff
From 1b7dfe48d6d66cad5d0368b8e8b387a4d9586ccd Mon Sep 17 00:00:00 2001
|
|
From: Daan De Meyer <daan.j.demeyer@gmail.com>
|
|
Date: Thu, 27 Oct 2022 11:12:10 +0200
|
|
Subject: [PATCH] condition: Check that subsystem is enabled in
|
|
ConditionSecurity=tpm2
|
|
|
|
Instead of succeeding when either the firmware reports a TPM device
|
|
or we find a TPM device, let's check that the firmware reports a TPM
|
|
device and the TPM subsystem is enabled in the kernel.
|
|
|
|
To check whether the subsystem enabled, we check if the relevant
|
|
subdirectory in /sys exists at all.
|
|
|
|
(cherry picked from commit 300bba79c22e4be1effe2faad0e59ac725d396a1)
|
|
|
|
Related #2138081
|
|
---
|
|
man/systemd-creds.xml | 4 ++--
|
|
src/creds/creds.c | 6 ++++--
|
|
src/shared/condition.c | 9 ++++-----
|
|
src/shared/tpm2-util.c | 6 +++++-
|
|
src/shared/tpm2-util.h | 11 ++++++-----
|
|
5 files changed, 21 insertions(+), 15 deletions(-)
|
|
|
|
diff --git a/man/systemd-creds.xml b/man/systemd-creds.xml
|
|
index 1e5632e63d..003fbcd463 100644
|
|
--- a/man/systemd-creds.xml
|
|
+++ b/man/systemd-creds.xml
|
|
@@ -175,8 +175,8 @@
|
|
by the OS kernel drivers and by userspace (i.e. systemd) this prints <literal>yes</literal> and exits
|
|
with exit status zero. If no such device is discovered/supported/used, prints
|
|
<literal>no</literal>. Otherwise prints <literal>partial</literal>. In either of these two cases
|
|
- exits with non-zero exit status. It also shows three lines indicating separately whether drivers,
|
|
- firmware and the system discovered/support/use TPM2.</para>
|
|
+ exits with non-zero exit status. It also shows four lines indicating separately whether firmware,
|
|
+ drivers, the system and the kernel discovered/support/use TPM2.</para>
|
|
|
|
<para>Combine with <option>--quiet</option> to suppress the output.</para></listitem>
|
|
</varlistentry>
|
|
diff --git a/src/creds/creds.c b/src/creds/creds.c
|
|
index 5586fd776a..a755a52c34 100644
|
|
--- a/src/creds/creds.c
|
|
+++ b/src/creds/creds.c
|
|
@@ -637,10 +637,12 @@ static int verb_has_tpm2(int argc, char **argv, void *userdata) {
|
|
|
|
printf("%sfirmware\n"
|
|
"%sdriver\n"
|
|
- "%ssystem\n",
|
|
+ "%ssystem\n"
|
|
+ "%ssubsystem\n",
|
|
plus_minus(s & TPM2_SUPPORT_FIRMWARE),
|
|
plus_minus(s & TPM2_SUPPORT_DRIVER),
|
|
- plus_minus(s & TPM2_SUPPORT_SYSTEM));
|
|
+ plus_minus(s & TPM2_SUPPORT_SYSTEM),
|
|
+ plus_minus(s & TPM2_SUPPORT_SUBSYSTEM));
|
|
}
|
|
|
|
/* Return inverted bit flags. So that TPM2_SUPPORT_FULL becomes EXIT_SUCCESS and the other values
|
|
diff --git a/src/shared/condition.c b/src/shared/condition.c
|
|
index 310ffcbdc6..a23d6a3e45 100644
|
|
--- a/src/shared/condition.c
|
|
+++ b/src/shared/condition.c
|
|
@@ -664,14 +664,13 @@ static int condition_test_ac_power(Condition *c, char **env) {
|
|
}
|
|
|
|
static int has_tpm2(void) {
|
|
- /* Checks whether the system has at least one TPM2 resource manager device, i.e. at least one "tpmrm"
|
|
- * class device. Alternatively, we are also happy if the firmware reports support (this is to cover
|
|
- * for cases where we simply haven't loaded the driver for it yet, i.e. during early boot where we
|
|
- * very likely want to use this condition check).
|
|
+ /* Checks whether the kernel has the TPM subsystem enabled and the firmware reports support. Note
|
|
+ * we don't check for actual TPM devices, since we might not have loaded the driver for it yet, i.e.
|
|
+ * during early boot where we very likely want to use this condition check).
|
|
*
|
|
* Note that we don't check if we ourselves are built with TPM2 support here! */
|
|
|
|
- return (tpm2_support() & (TPM2_SUPPORT_DRIVER|TPM2_SUPPORT_FIRMWARE)) != 0;
|
|
+ return FLAGS_SET(tpm2_support(), TPM2_SUPPORT_SUBSYSTEM|TPM2_SUPPORT_FIRMWARE);
|
|
}
|
|
|
|
static int condition_test_security(Condition *c, char **env) {
|
|
diff --git a/src/shared/tpm2-util.c b/src/shared/tpm2-util.c
|
|
index 13e92c4144..65e8d48347 100644
|
|
--- a/src/shared/tpm2-util.c
|
|
+++ b/src/shared/tpm2-util.c
|
|
@@ -2189,7 +2189,11 @@ Tpm2Support tpm2_support(void) {
|
|
if (r != -ENOENT)
|
|
log_debug_errno(r, "Unable to test whether /sys/class/tpmrm/ exists and is populated, assuming it is not: %m");
|
|
} else if (r == 0) /* populated! */
|
|
- support |= TPM2_SUPPORT_DRIVER;
|
|
+ support |= TPM2_SUPPORT_SUBSYSTEM|TPM2_SUPPORT_DRIVER;
|
|
+ else
|
|
+ /* If the directory exists but is empty, we know the subsystem is enabled but no
|
|
+ * driver has been loaded yet. */
|
|
+ support |= TPM2_SUPPORT_SUBSYSTEM;
|
|
}
|
|
|
|
if (efi_has_tpm2())
|
|
diff --git a/src/shared/tpm2-util.h b/src/shared/tpm2-util.h
|
|
index 048c28d6ca..c240335ae6 100644
|
|
--- a/src/shared/tpm2-util.h
|
|
+++ b/src/shared/tpm2-util.h
|
|
@@ -137,11 +137,12 @@ typedef struct {
|
|
typedef enum Tpm2Support {
|
|
/* NOTE! The systemd-creds tool returns these flags 1:1 as exit status. Hence these flags are pretty
|
|
* much ABI! Hence, be extra careful when changing/extending these definitions. */
|
|
- TPM2_SUPPORT_NONE = 0, /* no support */
|
|
- TPM2_SUPPORT_FIRMWARE = 1 << 0, /* firmware reports TPM2 was used */
|
|
- TPM2_SUPPORT_DRIVER = 1 << 1, /* the kernel has a driver loaded for it */
|
|
- TPM2_SUPPORT_SYSTEM = 1 << 2, /* we support it ourselves */
|
|
- TPM2_SUPPORT_FULL = TPM2_SUPPORT_FIRMWARE|TPM2_SUPPORT_DRIVER|TPM2_SUPPORT_SYSTEM,
|
|
+ TPM2_SUPPORT_NONE = 0, /* no support */
|
|
+ TPM2_SUPPORT_FIRMWARE = 1 << 0, /* firmware reports TPM2 was used */
|
|
+ TPM2_SUPPORT_DRIVER = 1 << 1, /* the kernel has a driver loaded for it */
|
|
+ TPM2_SUPPORT_SYSTEM = 1 << 2, /* we support it ourselves */
|
|
+ TPM2_SUPPORT_SUBSYSTEM = 1 << 3, /* the kernel has the tpm subsystem enabled */
|
|
+ TPM2_SUPPORT_FULL = TPM2_SUPPORT_FIRMWARE|TPM2_SUPPORT_DRIVER|TPM2_SUPPORT_SYSTEM|TPM2_SUPPORT_SUBSYSTEM,
|
|
} Tpm2Support;
|
|
|
|
Tpm2Support tpm2_support(void);
|