From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751760AbcFXOhp (ORCPT ); Fri, 24 Jun 2016 10:37:45 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]:9154 "EHLO mx0a-001b2d01.pphosted.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1751997AbcFXOhF (ORCPT ); Fri, 24 Jun 2016 10:37:05 -0400 X-IBM-Helo: d03dlp02.boulder.ibm.com X-IBM-MailFrom: stefanb@linux.vnet.ibm.com From: Stefan Berger To: tpmdd-devel@lists.sourceforge.net Cc: jgunthorpe@obsidianresearch.com, jarkko.sakkinen@linux.intel.com, linux-kernel@vger.kernel.org, linux-security-module@vger.kernel.org, Stefan Berger Subject: [PATCH] tpm: vtpm_proxy: Introduce flag to prevent sysfs entries Date: Fri, 24 Jun 2016 10:36:55 -0400 X-Mailer: git-send-email 2.4.3 X-TM-AS-GCONF: 00 X-Content-Scanned: Fidelis XPS MAILER x-cbid: 16062414-0028-0000-0000-000005082228 X-IBM-AV-DETECTION: SAVI=unused REMOTE=unused XFE=unused x-cbparentid: 16062414-0029-0000-0000-00002CF516C9 Message-Id: <1466779015-26965-1-git-send-email-stefanb@linux.vnet.ibm.com> X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:,, definitions=2016-06-24_07:,, signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=5 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1604210000 definitions=main-1606240159 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Introduce TPM_VTPM_PROXY_NO_SYSFS flag that prevents a vtpm_proxy driver instance from having the typical sysfs entries that shows the state of the TPM. The flag is to be set in the ioctl creating the vtpm_proxy device pair and maps on a new chip flags TPM_CHIP_FLAG_NO_SYSFS. This flag would be set by a container management stack to prevent TPM related information leakage between containers who share entries in sysfs. Signed-off-by: Stefan Berger --- drivers/char/tpm/tpm-chip.c | 2 +- drivers/char/tpm/tpm.h | 1 + drivers/char/tpm/tpm_vtpm_proxy.c | 5 ++++- include/uapi/linux/vtpm_proxy.h | 3 ++- 4 files changed, 8 insertions(+), 3 deletions(-) diff --git a/drivers/char/tpm/tpm-chip.c b/drivers/char/tpm/tpm-chip.c index 1965dc7..c8e7cab 100644 --- a/drivers/char/tpm/tpm-chip.c +++ b/drivers/char/tpm/tpm-chip.c @@ -278,7 +278,7 @@ static void tpm_del_char_device(struct tpm_chip *chip) static int tpm1_chip_register(struct tpm_chip *chip) { - if (chip->flags & TPM_CHIP_FLAG_TPM2) + if (chip->flags & (TPM_CHIP_FLAG_TPM2 | TPM_CHIP_FLAG_NO_SYSFS)) return 0; tpm_sysfs_add_device(chip); diff --git a/drivers/char/tpm/tpm.h b/drivers/char/tpm/tpm.h index 8890df2..9d8cf81 100644 --- a/drivers/char/tpm/tpm.h +++ b/drivers/char/tpm/tpm.h @@ -143,6 +143,7 @@ enum tpm_chip_flags { TPM_CHIP_FLAG_TPM2 = BIT(1), TPM_CHIP_FLAG_IRQ = BIT(2), TPM_CHIP_FLAG_VIRTUAL = BIT(3), + TPM_CHIP_FLAG_NO_SYSFS = BIT(4), }; struct tpm_chip { diff --git a/drivers/char/tpm/tpm_vtpm_proxy.c b/drivers/char/tpm/tpm_vtpm_proxy.c index 86e27e8..81079e0 100644 --- a/drivers/char/tpm/tpm_vtpm_proxy.c +++ b/drivers/char/tpm/tpm_vtpm_proxy.c @@ -50,7 +50,7 @@ struct proxy_dev { }; /* all supported flags */ -#define VTPM_PROXY_FLAGS_ALL (VTPM_PROXY_FLAG_TPM2) +#define VTPM_PROXY_FLAGS_ALL (VTPM_PROXY_FLAG_TPM2 | VTPM_PROXY_FLAG_NO_SYSFS) static struct workqueue_struct *workqueue; @@ -490,6 +490,9 @@ static struct file *vtpm_proxy_create_device( if (proxy_dev->flags & VTPM_PROXY_FLAG_TPM2) proxy_dev->chip->flags |= TPM_CHIP_FLAG_TPM2; + if (proxy_dev->flags & VTPM_PROXY_FLAG_NO_SYSFS) + proxy_dev->chip->flags |= TPM_CHIP_FLAG_NO_SYSFS; + vtpm_proxy_work_start(proxy_dev); vtpm_new_dev->fd = fd; diff --git a/include/uapi/linux/vtpm_proxy.h b/include/uapi/linux/vtpm_proxy.h index 41e8e22..151ea48 100644 --- a/include/uapi/linux/vtpm_proxy.h +++ b/include/uapi/linux/vtpm_proxy.h @@ -29,7 +29,8 @@ struct vtpm_proxy_new_dev { }; /* above flags */ -#define VTPM_PROXY_FLAG_TPM2 1 /* emulator is TPM 2 */ +#define VTPM_PROXY_FLAG_TPM2 1 /* emulator is TPM 2 */ +#define VTPM_PROXY_FLAG_NO_SYSFS 2 /* no sysfs for vTPM proxy instance */ #define VTPM_PROXY_IOC_NEW_DEV _IOWR(0xa1, 0x00, struct vtpm_proxy_new_dev) -- 2.4.3