tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

KEYS: trusted: allow use of TEE as backend without TCG_TPM support

With recent rework, trusted keys are no longer limited to TPM as trust
source. The Kconfig symbol is unchanged however leading to a few issues:

- TCG_TPM is required, even if only TEE is to be used
- Enabling TCG_TPM, but excluding it from available trusted sources
is not possible
- TEE=m && TRUSTED_KEYS=y will lead to TEE support being silently
dropped, which is not the best user experience

Remedy these issues by introducing two new boolean Kconfig symbols:
TRUSTED_KEYS_TPM and TRUSTED_KEYS_TEE with the appropriate
dependencies.

Any new code depending on the TPM trusted key backend in particular
or symbols exported by it will now need to explicitly state that it

depends on TRUSTED_KEYS && TRUSTED_KEYS_TPM

The latter to ensure the dependency is built and the former to ensure
it's reachable for module builds. There are no such users yet.

Reviewed-by: Sumit Garg <sumit.garg@linaro.org>
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
Reviewed-by: Pankaj Gupta <pankaj.gupta@nxp.com>
Tested-by: Pankaj Gupta <pankaj.gupta@nxp.com>
Tested-by: Andreas Rammhold <andreas@rammhold.de>
Tested-by: Tim Harvey <tharvey@gateworks.com>
Tested-by: Michael Walle <michael@walle.cc> # on ls1028a (non-E and E)
Tested-by: John Ernberg <john.ernberg@actia.se> # iMX8QXP
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>

authored by

Ahmad Fatoum and committed by
Jarkko Sakkinen be07858f af402ee3

+42 -17
+7 -11
security/keys/Kconfig
··· 70 70 71 71 config TRUSTED_KEYS 72 72 tristate "TRUSTED KEYS" 73 - depends on KEYS && TCG_TPM 74 - select CRYPTO 75 - select CRYPTO_HMAC 76 - select CRYPTO_SHA1 77 - select CRYPTO_HASH_INFO 78 - select ASN1_ENCODER 79 - select OID_REGISTRY 80 - select ASN1 73 + depends on KEYS 81 74 help 82 75 This option provides support for creating, sealing, and unsealing 83 76 keys in the kernel. Trusted keys are random number symmetric keys, 84 - generated and RSA-sealed by the TPM. The TPM only unseals the keys, 85 - if the boot PCRs and other criteria match. Userspace will only ever 86 - see encrypted blobs. 77 + generated and sealed by a trust source selected at kernel boot-time. 78 + Userspace will only ever see encrypted blobs. 87 79 88 80 If you are unsure as to whether this is required, answer N. 81 + 82 + if TRUSTED_KEYS 83 + source "security/keys/trusted-keys/Kconfig" 84 + endif 89 85 90 86 config ENCRYPTED_KEYS 91 87 tristate "ENCRYPTED KEYS"
+29
security/keys/trusted-keys/Kconfig
··· 1 + config TRUSTED_KEYS_TPM 2 + bool "TPM-based trusted keys" 3 + depends on TCG_TPM >= TRUSTED_KEYS 4 + default y 5 + select CRYPTO 6 + select CRYPTO_HMAC 7 + select CRYPTO_SHA1 8 + select CRYPTO_HASH_INFO 9 + select ASN1_ENCODER 10 + select OID_REGISTRY 11 + select ASN1 12 + help 13 + Enable use of the Trusted Platform Module (TPM) as trusted key 14 + backend. Trusted keys are random number symmetric keys, 15 + which will be generated and RSA-sealed by the TPM. 16 + The TPM only unseals the keys, if the boot PCRs and other 17 + criteria match. 18 + 19 + config TRUSTED_KEYS_TEE 20 + bool "TEE-based trusted keys" 21 + depends on TEE >= TRUSTED_KEYS 22 + default y 23 + help 24 + Enable use of the Trusted Execution Environment (TEE) as trusted 25 + key backend. 26 + 27 + if !TRUSTED_KEYS_TPM && !TRUSTED_KEYS_TEE 28 + comment "No trust source selected!" 29 + endif
+4 -4
security/keys/trusted-keys/Makefile
··· 5 5 6 6 obj-$(CONFIG_TRUSTED_KEYS) += trusted.o 7 7 trusted-y += trusted_core.o 8 - trusted-y += trusted_tpm1.o 8 + trusted-$(CONFIG_TRUSTED_KEYS_TPM) += trusted_tpm1.o 9 9 10 10 $(obj)/trusted_tpm2.o: $(obj)/tpm2key.asn1.h 11 - trusted-y += trusted_tpm2.o 12 - trusted-y += tpm2key.asn1.o 11 + trusted-$(CONFIG_TRUSTED_KEYS_TPM) += trusted_tpm2.o 12 + trusted-$(CONFIG_TRUSTED_KEYS_TPM) += tpm2key.asn1.o 13 13 14 - trusted-$(CONFIG_TEE) += trusted_tee.o 14 + trusted-$(CONFIG_TRUSTED_KEYS_TEE) += trusted_tee.o
+2 -2
security/keys/trusted-keys/trusted_core.c
··· 27 27 MODULE_PARM_DESC(source, "Select trusted keys source (tpm or tee)"); 28 28 29 29 static const struct trusted_key_source trusted_key_sources[] = { 30 - #if IS_REACHABLE(CONFIG_TCG_TPM) 30 + #if defined(CONFIG_TRUSTED_KEYS_TPM) 31 31 { "tpm", &trusted_key_tpm_ops }, 32 32 #endif 33 - #if IS_REACHABLE(CONFIG_TEE) 33 + #if defined(CONFIG_TRUSTED_KEYS_TEE) 34 34 { "tee", &trusted_key_tee_ops }, 35 35 #endif 36 36 };