From patchwork Thu Nov 3 18:01:11 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Evan Green X-Patchwork-Id: 15075 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:6687:0:0:0:0:0 with SMTP id l7csp685477wru; Thu, 3 Nov 2022 11:05:28 -0700 (PDT) X-Google-Smtp-Source: AMsMyM6a6jxGYPoO209q6AUxd+jdcZxuGl2DTQfyBRRNwMU6cQOsxZHoO+uv+RzNr7p+elAS+lB3 X-Received: by 2002:a17:907:2e0b:b0:7a7:d37e:4650 with SMTP id ig11-20020a1709072e0b00b007a7d37e4650mr30816284ejc.261.1667498728119; Thu, 03 Nov 2022 11:05:28 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1667498728; cv=none; d=google.com; s=arc-20160816; b=SkbpKlOYJhmLHF5c6Y9Pkdknzq+8nBnRR9gWHtdFqaepkcdeBmTR+1BQ8/rek6cBTz gSRp38SXxw1zg+dEhuY+Jel07lgNArCeyEeA21ONqm+Usekfizo25kXdqektyHKB+cuM tSygqk0mX8OmoCoLZQjjVoaGqqaIZv0utdc93xibFh+DptZ3u10t98aZV7gmM3mXLS3i dtPklkA2a7iS+F1R5AZ1GX3xu9Rj8JOEiA7kShIpkjo/mRDuRYJAFQOFuQ0UlxLHftkS gEUzx+tY5OMGE/MwkgV9r7H6hhEkvqS/J4qvkUtBBsRbh7fJAf+bErJ3ZEuDYT5to4AY 1exg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=YgNHjxBxYUWB/PCbKrlrwrwc9VDJqlW54PKdqCwW8ic=; b=xHOUSbeVQseoO8NvCDMTAvOgmWfyt9hc36tXaQ/5AaR3BtIzEtzweqQM+V7/9LxDiv KC0/YwEn1RIs1A9LzYUMMhh07LZ573mxHyRnmnxA8XQllddHRtAj5DwYwot5QXYFqfXj wCssJugxN/iWvgyCKcCKt3VvqkpIcnFBCq3QDvSzvloOs7f7pzi6y+mym2S8VZJyf2OS M1+lOgOxoRCatWtv+zpsSE3pvCXq/7P6tFlFVufV8ujFJOd9fJbL1zy8G0ci1ORnrnJS jDhuG8HbWFblQ05cJvOCRjg3zOm84c48ZOFe9z8WDVgEjeZNgaoxfeP0f84DiYxYlWuQ sLhg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@chromium.org header.s=google header.b=AStpaMSz; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=chromium.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id qq18-20020a17090720d200b00773db351c39si1493655ejb.64.2022.11.03.11.05.03; Thu, 03 Nov 2022 11:05:28 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@chromium.org header.s=google header.b=AStpaMSz; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=chromium.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230047AbiKCSEq (ORCPT + 99 others); Thu, 3 Nov 2022 14:04:46 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:37430 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230427AbiKCSEB (ORCPT ); Thu, 3 Nov 2022 14:04:01 -0400 Received: from mail-pj1-x102b.google.com (mail-pj1-x102b.google.com [IPv6:2607:f8b0:4864:20::102b]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 712C5233AF for ; Thu, 3 Nov 2022 11:01:42 -0700 (PDT) Received: by mail-pj1-x102b.google.com with SMTP id u8-20020a17090a5e4800b002106dcdd4a0so6003921pji.1 for ; Thu, 03 Nov 2022 11:01:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=YgNHjxBxYUWB/PCbKrlrwrwc9VDJqlW54PKdqCwW8ic=; b=AStpaMSzeObtZoItnIgikawKuuo5Qq71b1rLR3rkcbld1k90YwIpcDKtGID+9H3Wxv mIkg68yA2nOb1F042C3Gf6qWKKYczZzj0+RfL1qnS2jhStKdZN/l3jY/d76fv4Jv5xT+ 2oHWymVaZW0NMQTpKgdvsa1VfM2CLlGnYdLxM= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=YgNHjxBxYUWB/PCbKrlrwrwc9VDJqlW54PKdqCwW8ic=; b=IBL1li95EEcZgwo5eCbEEFVMAivk0vUspEkDjjVTnHV+85lwt4mLOdeITV4HbejM14 6K/TZXz5db0mf+dqbQMaQEQ9cbcQ5Gmj8VHijo3mUIYXp7VVI+yPqFsr5eeNFgNq4qk1 ntB20p5MJvgp0aD5tFEU6LsDFi/GaVWEJLcR+A7YOSiwXzkMRTbbsVdrbJMYMbX3ofF7 MaD3GYvhudMsBtC7ix52Vj+Fyjx7JAJW3tzLdDHl4tL+2F/+4wpS82MjmIeotVrrF5E0 pjCanFHm/I6tBagQOXqVMLE15LpEapWbvomqOywxzPLal/NGB2eRBtEcku0Uh2dWvTUM //yA== X-Gm-Message-State: ACrzQf1GvqwoYgUpxOEKwtfPVxzG1oL9MSSBx7bqsin+STVqQucSTDSe ucII5qb+NK8tk3IRXRxBSkg8wHq5t60G9SGr X-Received: by 2002:a17:902:8e84:b0:178:57e4:805b with SMTP id bg4-20020a1709028e8400b0017857e4805bmr31426128plb.144.1667498502037; Thu, 03 Nov 2022 11:01:42 -0700 (PDT) Received: from evgreen-glaptop.lan ([98.45.28.95]) by smtp.gmail.com with ESMTPSA id t12-20020a1709027fcc00b00177fb862a87sm1000277plb.20.2022.11.03.11.01.40 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 03 Nov 2022 11:01:41 -0700 (PDT) From: Evan Green To: linux-kernel@vger.kernel.org Cc: corbet@lwn.net, linux-pm@vger.kernel.org, rjw@rjwysocki.net, gwendal@chromium.org, apronin@chromium.org, Pavel Machek , Kees Cook , Matthew Garrett , linux-integrity@vger.kernel.org, jejb@linux.ibm.com, zohar@linux.ibm.com, dlunev@google.com, Eric Biggers , Ben Boeckel , jarkko@kernel.org, Matthew Garrett , Matthew Garrett , Evan Green , Jason Gunthorpe , Peter Huewe Subject: [PATCH v4 03/11] tpm: Allow PCR 23 to be restricted to kernel-only use Date: Thu, 3 Nov 2022 11:01:11 -0700 Message-Id: <20221103105558.v4.3.I9ded8c8caad27403e9284dfc78ad6cbd845bc98d@changeid> X-Mailer: git-send-email 2.38.1.431.g37b22c650d-goog In-Reply-To: <20221103180120.752659-1-evgreen@chromium.org> References: <20221103180120.752659-1-evgreen@chromium.org> MIME-Version: 1.0 X-Spam-Status: No, score=-3.1 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_NONE, SPF_HELO_NONE,SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1748499146574682440?= X-GMAIL-MSGID: =?utf-8?q?1748499146574682440?= From: Matthew Garrett Introduce a new Kconfig, TCG_TPM_RESTRICT_PCR, which if enabled restricts usermode's ability to extend or reset PCR 23. Under certain circumstances it might be desirable to enable the creation of TPM-backed secrets that are only accessible to the kernel. In an ideal world this could be achieved by using TPM localities, but these don't appear to be available on consumer systems. An alternative is to simply block userland from modifying one of the resettable PCRs, leaving it available to the kernel. If the kernel ensures that no userland can access the TPM while it is carrying out work, it can reset PCR 23, extend it to an arbitrary value, create or load a secret, and then reset the PCR again. Even if userland somehow obtains the sealed material, it will be unable to unseal it since PCR 23 will never be in the appropriate state. This Kconfig is only properly supported for systems with TPM2 devices. For systems with TPM1 devices, having this Kconfig enabled completely restricts usermode's access to the TPM. TPM1 contains support for tunnelled transports, which usermode could use to smuggle commands through that this Kconfig is attempting to restrict. Link: https://lore.kernel.org/lkml/20210220013255.1083202-3-matthewgarrett@google.com/ Signed-off-by: Matthew Garrett Signed-off-by: Evan Green --- Changes in v4: - Augment the commit message (Jarkko) Changes in v3: - Fix up commit message (Jarkko) - tpm2_find_and_validate_cc() was split (Jarkko) - Simply fully restrict TPM1 since v2 failed to account for tunnelled transport sessions (Stefan and Jarkko). Changes in v2: - Fixed sparse warnings drivers/char/tpm/Kconfig | 12 ++++++++++++ drivers/char/tpm/tpm-dev-common.c | 8 ++++++++ drivers/char/tpm/tpm.h | 19 +++++++++++++++++++ drivers/char/tpm/tpm1-cmd.c | 13 +++++++++++++ drivers/char/tpm/tpm2-cmd.c | 22 ++++++++++++++++++++++ 5 files changed, 74 insertions(+) diff --git a/drivers/char/tpm/Kconfig b/drivers/char/tpm/Kconfig index 927088b2c3d3f2..c8ed54c66e399a 100644 --- a/drivers/char/tpm/Kconfig +++ b/drivers/char/tpm/Kconfig @@ -211,4 +211,16 @@ config TCG_FTPM_TEE This driver proxies for firmware TPM running in TEE. source "drivers/char/tpm/st33zp24/Kconfig" + +config TCG_TPM_RESTRICT_PCR + bool "Restrict userland access to PCR 23" + depends on TCG_TPM + help + If set, block userland from extending or resetting PCR 23. This allows it + to be restricted to in-kernel use, preventing userland from being able to + make use of data sealed to the TPM by the kernel. This is required for + secure hibernation support, but should be left disabled if any userland + may require access to PCR23. This is a TPM2-only feature, and if enabled + on a TPM1 machine will cause all usermode TPM commands to return EPERM due + to the complications introduced by tunnelled sessions in TPM1.2. endif # TCG_TPM diff --git a/drivers/char/tpm/tpm-dev-common.c b/drivers/char/tpm/tpm-dev-common.c index dc4c0a0a512903..7a4e618c7d1942 100644 --- a/drivers/char/tpm/tpm-dev-common.c +++ b/drivers/char/tpm/tpm-dev-common.c @@ -198,6 +198,14 @@ ssize_t tpm_common_write(struct file *file, const char __user *buf, priv->response_read = false; *off = 0; + if (priv->chip->flags & TPM_CHIP_FLAG_TPM2) + ret = tpm2_cmd_restricted(priv->chip, priv->data_buffer, size); + else + ret = tpm1_cmd_restricted(priv->chip, priv->data_buffer, size); + + if (ret) + goto out; + /* * If in nonblocking mode schedule an async job to send * the command return the size. diff --git a/drivers/char/tpm/tpm.h b/drivers/char/tpm/tpm.h index f1e0f490176f01..c0845e3f9eda17 100644 --- a/drivers/char/tpm/tpm.h +++ b/drivers/char/tpm/tpm.h @@ -245,4 +245,23 @@ void tpm_bios_log_setup(struct tpm_chip *chip); void tpm_bios_log_teardown(struct tpm_chip *chip); int tpm_dev_common_init(void); void tpm_dev_common_exit(void); + +#ifdef CONFIG_TCG_TPM_RESTRICT_PCR +#define TPM_RESTRICTED_PCR 23 + +int tpm1_cmd_restricted(struct tpm_chip *chip, u8 *buffer, size_t size); +int tpm2_cmd_restricted(struct tpm_chip *chip, u8 *buffer, size_t size); +#else +static inline int tpm1_cmd_restricted(struct tpm_chip *chip, u8 *buffer, + size_t size) +{ + return 0; +} + +static inline int tpm2_cmd_restricted(struct tpm_chip *chip, u8 *buffer, + size_t size) +{ + return 0; +} +#endif #endif diff --git a/drivers/char/tpm/tpm1-cmd.c b/drivers/char/tpm/tpm1-cmd.c index cf64c738510529..1869e89215fcb9 100644 --- a/drivers/char/tpm/tpm1-cmd.c +++ b/drivers/char/tpm/tpm1-cmd.c @@ -811,3 +811,16 @@ int tpm1_get_pcr_allocation(struct tpm_chip *chip) return 0; } + +#ifdef CONFIG_TCG_TPM_RESTRICT_PCR +int tpm1_cmd_restricted(struct tpm_chip *chip, u8 *buffer, size_t size) +{ + /* + * Restrict all usermode commands on TPM1.2. Ideally we'd just restrict + * TPM_ORD_PCR_EXTEND and TPM_ORD_PCR_RESET, but TPM1.2 also supports + * tunnelled transport sessions where the kernel would be unable to filter + * commands. + */ + return -EPERM; +} +#endif diff --git a/drivers/char/tpm/tpm2-cmd.c b/drivers/char/tpm/tpm2-cmd.c index 303ce2ea02a4b0..e0503cfd7bcfee 100644 --- a/drivers/char/tpm/tpm2-cmd.c +++ b/drivers/char/tpm/tpm2-cmd.c @@ -778,3 +778,25 @@ int tpm2_find_cc(struct tpm_chip *chip, u32 cc) return -1; } + +#ifdef CONFIG_TCG_TPM_RESTRICT_PCR +int tpm2_cmd_restricted(struct tpm_chip *chip, u8 *buffer, size_t size) +{ + int cc = tpm2_find_and_validate_cc(chip, NULL, buffer, size); + __be32 *handle; + + switch (cc) { + case TPM2_CC_PCR_EXTEND: + case TPM2_CC_PCR_RESET: + if (size < (TPM_HEADER_SIZE + sizeof(u32))) + return -EINVAL; + + handle = (__be32 *)&buffer[TPM_HEADER_SIZE]; + if (be32_to_cpu(*handle) == TPM_RESTRICTED_PCR) + return -EPERM; + break; + } + + return 0; +} +#endif