151 lines
5.4 KiB
Diff
151 lines
5.4 KiB
Diff
From 8776c467e8d5a95fcbcd252ce737dea7b1bd1a8a Mon Sep 17 00:00:00 2001
|
|
From: Juergen Repp <juergen_repp@web.de>
|
|
Date: Thu, 5 Mar 2026 21:47:17 +0100
|
|
Subject: [PATCH 28/30] tpm2_createak: add attribute option.
|
|
|
|
The default attributes for the ak are:
|
|
"restricted|userwithauth|sign|fixedtpm|fixedparent|sensitivedataorigin"
|
|
This default setting differs from the settings in the specification
|
|
TPM 2.0 Keys for Device Identity and Attestation. "adminwithpolicy"
|
|
is not set. Thus the option -a, --attributes is added.
|
|
Addresses: #3225
|
|
|
|
Signed-off-by: Juergen Repp <juergen_repp@web.de>
|
|
---
|
|
man/tpm2_createak.1.md | 9 +++++++++
|
|
test/integration/tests/createak.sh | 13 +++++++++++--
|
|
tools/tpm2_createak.c | 19 +++++++++++++++++--
|
|
3 files changed, 37 insertions(+), 4 deletions(-)
|
|
|
|
diff --git a/man/tpm2_createak.1.md b/man/tpm2_createak.1.md
|
|
index adcda09a..883d7fa5 100644
|
|
--- a/man/tpm2_createak.1.md
|
|
+++ b/man/tpm2_createak.1.md
|
|
@@ -48,6 +48,15 @@ loaded-key:
|
|
* **rsa** - An RSA2048 key.
|
|
* **keyedhash** - hmac key.
|
|
|
|
+ * **-a**, **\--attributes**=_ATTRIBUTES_:
|
|
+
|
|
+ The object attributes, optional. The default for created objects is:
|
|
+ "restricted|userwithauth|sign|fixedtpm|fixedparent|sensitivedataorigin"
|
|
+ This default setting differs from the settings in the specification
|
|
+ TPM 2.0 Keys for Device Identity and Attestation. "adminwithpolicy" is
|
|
+ not set and can be added to the default:
|
|
+ "restricted|userwithauth|...|adminwithpolicy"
|
|
+
|
|
* **-g**, **\--hash-algorithm**=_ALGORITHM_:
|
|
|
|
Specifies the digest algorithm used for signing.
|
|
diff --git a/test/integration/tests/createak.sh b/test/integration/tests/createak.sh
|
|
index 7067f9d2..b8fb1d44 100644
|
|
--- a/test/integration/tests/createak.sh
|
|
+++ b/test/integration/tests/createak.sh
|
|
@@ -3,7 +3,7 @@
|
|
source helpers.sh
|
|
|
|
cleanup() {
|
|
- rm -f ek.pub ak.pub ak.name ak.name ak.log
|
|
+ rm -f ek.pub ak.pub ak.name ak.name ak.log ek.ctx
|
|
|
|
# Evict persistent handles, we want them to always succeed and never trip
|
|
# the onerror trap.
|
|
@@ -26,7 +26,7 @@ cleanup "no-shut-down"
|
|
tpm2 createek -Q -c 0x8101000b -G rsa -u ek.pub
|
|
|
|
tpm2 createak -Q -C 0x8101000b -c ak.ctx -G rsa -g sha256 -s rsassa -u ak.pub \
|
|
--n ak.name -q ak.qname
|
|
+ -n ak.name -q ak.qname
|
|
|
|
# Validate the qname
|
|
tpm2 readpublic -c ak.ctx -q ak.qname2
|
|
@@ -45,4 +45,13 @@ tpm2 changeauth -c e endauth
|
|
tpm2 createek -Q -P endauth -c 0x8101000b -G rsa -u ek.pub
|
|
tpm2 createak -Q -P endauth -C 0x8101000b -c ak.ctx -G rsa -u ak.pub -n ak.name
|
|
|
|
+# Check attributes different from default
|
|
+tpm2 createak -Q -Q -P endauth -C 0x8101000b -c ak.ctx -u ak.pub -n ak.name \
|
|
+ -a "restricted|userwithauth|sign|fixedtpm|fixedparent|sensitivedataorigin|adminwithpolicy"
|
|
+
|
|
+# Check whether non default attribute was set
|
|
+tpm2 readpublic -c ak.ctx | grep adminwithpolicy
|
|
+
|
|
+
|
|
+
|
|
exit 0
|
|
diff --git a/tools/tpm2_createak.c b/tools/tpm2_createak.c
|
|
index 8239e5f4..d9d5a869 100644
|
|
--- a/tools/tpm2_createak.c
|
|
+++ b/tools/tpm2_createak.c
|
|
@@ -12,6 +12,7 @@
|
|
#include "tpm2_auth_util.h"
|
|
#include "tpm2_convert.h"
|
|
#include "tpm2_tool.h"
|
|
+#include "tpm2_attr_util.h"
|
|
|
|
#define ATTRS \
|
|
TPMA_OBJECT_RESTRICTED|TPMA_OBJECT_USERWITHAUTH| \
|
|
@@ -108,6 +109,7 @@ struct createak_context {
|
|
const char *qname_file;
|
|
} out;
|
|
char *auth_str;
|
|
+ char *attrs;
|
|
} ak;
|
|
struct {
|
|
UINT8 f :1;
|
|
@@ -136,6 +138,7 @@ static tool_rc init_ak_public(TPMI_ALG_HASH name_alg, TPM2B_PUBLIC *public) {
|
|
|
|
const char *name_halg;
|
|
char alg[256];
|
|
+ TPMA_OBJECT attrs;
|
|
|
|
name_halg = tpm2_alg_util_algtostr(name_alg, tpm2_alg_util_flags_hash);
|
|
|
|
@@ -159,7 +162,15 @@ static tool_rc init_ak_public(TPMI_ALG_HASH name_alg, TPM2B_PUBLIC *public) {
|
|
snprintf(alg, sizeof(alg), "%s:%s-%s:null", ctx.ak.in.alg.type,
|
|
ctx.ak.in.alg.sign, ctx.ak.in.alg.digest);
|
|
}
|
|
- return tpm2_alg_util_public_init(alg, name_halg, NULL, NULL, ATTRS, public);
|
|
+ if (ctx.ak.attrs) {
|
|
+ if (!tpm2_attr_util_obj_from_optarg(ctx.ak.attrs, &attrs)) {
|
|
+ LOG_ERR("Invalid attributes.");
|
|
+ return tool_rc_general_error;
|
|
+ }
|
|
+ } else {
|
|
+ attrs = ATTRS;
|
|
+ }
|
|
+ return tpm2_alg_util_public_init(alg, name_halg, NULL, NULL, attrs, public);
|
|
}
|
|
|
|
static tool_rc create_ak(ESYS_CONTEXT *ectx) {
|
|
@@ -464,6 +475,9 @@ static bool on_option(char key, char *value) {
|
|
case 'R':
|
|
ctx.autoflush = true;
|
|
break;
|
|
+ case 'a':
|
|
+ ctx.ak.attrs = value;
|
|
+ break;
|
|
}
|
|
|
|
return true;
|
|
@@ -479,6 +493,7 @@ static bool tpm2_tool_onstart(tpm2_options **opts) {
|
|
{ "ak-name", required_argument, NULL, 'n' },
|
|
{ "key-algorithm", required_argument, NULL, 'G' },
|
|
{ "hash-algorithm", required_argument, NULL, 'g' },
|
|
+ { "attributes", required_argument, NULL, 'a' },
|
|
{ "signing-algorithm", required_argument, NULL, 's' },
|
|
{ "format", required_argument, NULL, 'f' },
|
|
{ "public", required_argument, NULL, 'u' },
|
|
@@ -487,7 +502,7 @@ static bool tpm2_tool_onstart(tpm2_options **opts) {
|
|
{ "autoflush", no_argument, NULL, 'R' },
|
|
};
|
|
|
|
- *opts = tpm2_options_new("P:p:C:c:n:G:g:s:f:u:r:q:R", ARRAY_LEN(topts), topts,
|
|
+ *opts = tpm2_options_new("P:p:C:c:n:G:a:g:s:f:u:r:q:R", ARRAY_LEN(topts), topts,
|
|
on_option, NULL, 0);
|
|
|
|
return *opts != NULL;
|
|
--
|
|
2.54.0
|
|
|