[PATCH v2 1/6] KEYS: trusted: allow use of TEE as backend without TCG_TPM support
From: Ahmad Fatoum <a.fatoum@pengutronix.de>
Date: 2021-06-22 12:38:59
Also in:
keyrings, linux-crypto, linux-integrity, lkml
Subsystem:
keys-trusted, keys/keyrings, security subsystem, the rest · Maintainers:
James Bottomley, Jarkko Sakkinen, Mimi Zohar, David Howells, Paul Moore, James Morris, "Serge E. Hallyn", Linus Torvalds
With recent rework, trusted keys are no longer limited to TPM as trust source. The Kconfig symbol is unchanged however leading to a few issues: - TCG_TPM is required, even if only TEE is to be used - Enabling TCG_TPM, but excluding it from available trusted sources is not possible - TEE=m && TRUSTED_KEYS=y will lead to TEE support being silently dropped, which is not the best user experience Remedy these issues by introducing two new Kconfig symbols: TRUSTED_KEYS_TPM and TRUSTED_KEYS_TEE with the appropriate dependencies. Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de> --- To: James Bottomley <redacted> To: Jarkko Sakkinen <jarkko@kernel.org> To: Mimi Zohar <zohar@linux.ibm.com> To: David Howells <dhowells@redhat.com> Cc: James Morris <jmorris@namei.org> Cc: Eric Biggers <ebiggers@kernel.org> Cc: "Serge E. Hallyn" <serge@hallyn.com> Cc: "Horia Geantă" <horia.geanta@nxp.com> Cc: Aymen Sghaier <redacted> Cc: Udit Agarwal <redacted> Cc: Jan Luebbe <redacted> Cc: David Gstir <david@sigma-star.at> Cc: Richard Weinberger <richard@nod.at> Cc: Franck LENORMAND <redacted> Cc: Sumit Garg <redacted> Cc: keyrings@vger.kernel.org Cc: linux-crypto@vger.kernel.org Cc: linux-integrity@vger.kernel.org Cc: linux-kernel@vger.kernel.org Cc: linux-security-module@vger.kernel.org --- security/keys/Kconfig | 14 ++++++------- security/keys/trusted-keys/Kconfig | 25 ++++++++++++++++++++++++- security/keys/trusted-keys/Makefile | 8 +++++--- security/keys/trusted-keys/trusted_core.c | 4 ++-- 4 files changed, 39 insertions(+), 12 deletions(-) create mode 100644 security/keys/trusted-keys/Kconfig
diff --git a/security/keys/Kconfig b/security/keys/Kconfig
index 64b81abd087e..6fdb953b319f 100644
--- a/security/keys/Kconfig
+++ b/security/keys/Kconfig@@ -70,23 +70,23 @@ config BIG_KEYS config TRUSTED_KEYS tristate "TRUSTED KEYS" - depends on KEYS && TCG_TPM + depends on KEYS select CRYPTO select CRYPTO_HMAC select CRYPTO_SHA1 select CRYPTO_HASH_INFO - select ASN1_ENCODER - select OID_REGISTRY - select ASN1 help This option provides support for creating, sealing, and unsealing keys in the kernel. Trusted keys are random number symmetric keys, - generated and RSA-sealed by the TPM. The TPM only unseals the keys, - if the boot PCRs and other criteria match. Userspace will only ever - see encrypted blobs. + generated and sealed by a trust source selected at kernel boot-time. + Userspace will only ever see encrypted blobs. If you are unsure as to whether this is required, answer N. +if TRUSTED_KEYS +source "security/keys/trusted-keys/Kconfig" +endif + config ENCRYPTED_KEYS tristate "ENCRYPTED KEYS" depends on KEYS
diff --git a/security/keys/trusted-keys/Kconfig b/security/keys/trusted-keys/Kconfig
new file mode 100644
index 000000000000..24af4aaceebf
--- /dev/null
+++ b/security/keys/trusted-keys/Kconfig@@ -0,0 +1,25 @@ +config TRUSTED_KEYS_TPM + bool "TPM-based trusted keys" + depends on TCG_TPM >= TRUSTED_KEYS + default y + select ASN1_ENCODER + select OID_REGISTRY + select ASN1 + help + Enable use of the Trusted Platform Module (TPM) as trusted key + backend. Trusted keys are are random number symmetric keys, + which will be generated and RSA-sealed by the TPM. + The TPM only unseals the keys, if the boot PCRs and other + criteria match. + +config TRUSTED_KEYS_TEE + bool "TEE-based trusted keys" + depends on TEE >= TRUSTED_KEYS + default y + help + Enable use of the Trusted Execution Environment (TEE) as trusted + key backend. + +if !TRUSTED_KEYS_TPM && !TRUSTED_KEYS_TEE +comment "No trust source selected!" +endif
diff --git a/security/keys/trusted-keys/Makefile b/security/keys/trusted-keys/Makefile
index feb8b6c3cc79..96fc6c377398 100644
--- a/security/keys/trusted-keys/Makefile
+++ b/security/keys/trusted-keys/Makefile@@ -5,10 +5,12 @@ obj-$(CONFIG_TRUSTED_KEYS) += trusted.o trusted-y += trusted_core.o -trusted-y += trusted_tpm1.o +trusted-$(CONFIG_TRUSTED_KEYS_TPM) += trusted_tpm1.o $(obj)/trusted_tpm2.o: $(obj)/tpm2key.asn1.h -trusted-y += trusted_tpm2.o -trusted-y += tpm2key.asn1.o +trusted-$(CONFIG_TRUSTED_KEYS_TPM) += trusted_tpm2.o +trusted-$(CONFIG_TRUSTED_KEYS_TPM) += tpm2key.asn1.o + +trusted-$(CONFIG_TRUSTED_KEYS_TEE) += trusted_tee.o trusted-$(CONFIG_TEE) += trusted_tee.o
diff --git a/security/keys/trusted-keys/trusted_core.c b/security/keys/trusted-keys/trusted_core.c
index d5c891d8d353..8cab69e5d0da 100644
--- a/security/keys/trusted-keys/trusted_core.c
+++ b/security/keys/trusted-keys/trusted_core.c@@ -27,10 +27,10 @@ module_param_named(source, trusted_key_source, charp, 0); MODULE_PARM_DESC(source, "Select trusted keys source (tpm or tee)"); static const struct trusted_key_source trusted_key_sources[] = { -#if defined(CONFIG_TCG_TPM) +#if defined(CONFIG_TRUSTED_KEYS_TPM) { "tpm", &trusted_key_tpm_ops }, #endif -#if defined(CONFIG_TEE) +#if defined(CONFIG_TRUSTED_KEYS_TEE) { "tee", &trusted_key_tee_ops }, #endif };
--
git-series 0.9.1