Re: [PATCH v2 1/6] KEYS: trusted: allow use of TEE as backend without TCG_TPM support

Hello Sumit,

On 19.07.21 10:04, Sumit Garg wrote:

Hi Ahmad,

On Tue, 22 Jun 2021 at 18:08, Ahmad Fatoum [off-list ref] wrote:

quoted

With recent rework, trusted keys are no longer limited to TPM as trust
source. The Kconfig symbol is unchanged however leading to a few issues:

 - TCG_TPM is required, even if only TEE is to be used
 - Enabling TCG_TPM, but excluding it from available trusted sources
   is not possible
 - TEE=m && TRUSTED_KEYS=y will lead to TEE support being silently
   dropped, which is not the best user experience

Remedy these issues by introducing two new Kconfig symbols:
TRUSTED_KEYS_TPM and TRUSTED_KEYS_TEE with the appropriate
dependencies.

This should include a fixes tag to the rework commit.

Yes. I wasn't aware of the regression that Andreas (CC'd) recently
reported. Knowing, it now indeed warrants a backport. Will add in v2.

quoted

diff --git a/security/keys/Kconfig b/security/keys/Kconfig
index 64b81abd087e..6fdb953b319f 100644
--- a/security/keys/Kconfig
+++ b/security/keys/Kconfig

@@ -70,23 +70,23 @@ config BIG_KEYS

 config TRUSTED_KEYS
        tristate "TRUSTED KEYS"
-       depends on KEYS && TCG_TPM
+       depends on KEYS

quoted

        select CRYPTO
        select CRYPTO_HMAC
        select CRYPTO_SHA1
        select CRYPTO_HASH_INFO

Should move these as well to TRUSTED_KEYS_TPM as the core code doesn't
mandate their need.

Ok, will test and change appropriately.

quoted

-       select ASN1_ENCODER
-       select OID_REGISTRY
-       select ASN1

quoted

 $(obj)/trusted_tpm2.o: $(obj)/tpm2key.asn1.h
-trusted-y += trusted_tpm2.o
-trusted-y += tpm2key.asn1.o
+trusted-$(CONFIG_TRUSTED_KEYS_TPM) += trusted_tpm2.o
+trusted-$(CONFIG_TRUSTED_KEYS_TPM) += tpm2key.asn1.o
+
+trusted-$(CONFIG_TRUSTED_KEYS_TEE) += trusted_tee.o

 trusted-$(CONFIG_TEE) += trusted_tee.o

This should be dropped.

Right..

Thanks for the review. I'll isolate this patch for v2.

Cheers,
Ahmad


-- 
Pengutronix e.K.                           |                             |
Steuerwalder Str. 21                       | http://www.pengutronix.de/  |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |