Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.kernel > #80345 > unrolled thread
| Started by | Tj <debian@iam.tj> |
|---|---|
| First post | 2023-09-09 13:40 +0200 |
| Last post | 2023-09-14 07:10 +0200 |
| Articles | 3 — 3 participants |
Back to article view | Back to linux.debian.kernel
Bug#1051535: linux: HW_RANDOM_TPM disabled due to IMA=y Tj <debian@iam.tj> - 2023-09-09 13:40 +0200
Bug#1051535: linux: HW_RANDOM_TPM disabled due to IMA=y Salvatore Bonaccorso <carnil@debian.org> - 2023-09-09 14:10 +0200
Bug#1051535: marked as done (linux: HW_RANDOM_TPM disabled due to IMA=y) "Debian Bug Tracking System" <owner@bugs.debian.org> - 2023-09-14 07:10 +0200
| From | Tj <debian@iam.tj> |
|---|---|
| Date | 2023-09-09 13:40 +0200 |
| Subject | Bug#1051535: linux: HW_RANDOM_TPM disabled due to IMA=y |
| Message-ID | <Hc4tH-7N7t-1@gated-at.bofh.it> |
Source: linux
Severity: normal
Working with a Debian user in Matrix channel #Debian where they report
that the TPM hardware random number generator that was available in
v5.10* series is missing from v6.1* series for the amd64 kernel.
After examining the Kconfig options and the Debian configs I found that
due to commit 6e679322d7d "Re-enable IMA" that possibly inadvertently
it disabled HW_RANDOM_TPM.
The reason being that we have:
config HW_RANDOM_TPM
bool "TPM HW Random Number Generator support"
depends on TCG_TPM && HW_RANDOM && !(TCG_TPM=y && HW_RANDOM=m)
And when IMA=y that does:
config IMA
bool "Integrity Measurement Architecture(IMA)"
...
select TCG_TPM if HAS_IOMEM
And `select` will force the target to the same value as this option.
TCG_TPM is tri-state (n,y,m) but IMA is boolean (n,y) so this select
forces TCG_TPM=y.
so !(TCG_TPM=y && HW_RANDOM=m) is true and therefore HW_RANDOM_TPM is
not set.
$ grep -rnE 'CONFIG_(IMA|TCG_TPM|HW_RANDOM)=' debian/config /boot/config-6.1.0-11-amd64
debian/config/config:457:CONFIG_HW_RANDOM=m
debian/config/config:7752:CONFIG_IMA=y
debian/config/arm64/config:172:CONFIG_TCG_TPM=m
debian/config/kernelarch-x86/config:332:CONFIG_TCG_TPM=m
debian/config/config.cloud:149:CONFIG_TCG_TPM=m
/boot/config-6.1.0-11-amd64:4324:CONFIG_HW_RANDOM=m
/boot/config-6.1.0-11-amd64:4352:CONFIG_TCG_TPM=y
/boot/config-6.1.0-11-amd64:9774:CONFIG_IMA=y
-- System Information:
Debian Release: 12.1
Architecture: amd64 (x86_64)
Foreign Architectures: i386
[toc] | [next] | [standalone]
| From | Salvatore Bonaccorso <carnil@debian.org> |
|---|---|
| Date | 2023-09-09 14:10 +0200 |
| Message-ID | <Hc4WJ-7Nxt-9@gated-at.bofh.it> |
| In reply to | #80345 |
Hi, Thanks for the report. On Sat, Sep 09, 2023 at 12:38:21PM +0100, Tj wrote: > Source: linux > Severity: normal > > Working with a Debian user in Matrix channel #Debian where they report > that the TPM hardware random number generator that was available in > v5.10* series is missing from v6.1* series for the amd64 kernel. > > After examining the Kconfig options and the Debian configs I found that > due to commit 6e679322d7d "Re-enable IMA" that possibly inadvertently > it disabled HW_RANDOM_TPM. > > The reason being that we have: > > config HW_RANDOM_TPM > bool "TPM HW Random Number Generator support" > depends on TCG_TPM && HW_RANDOM && !(TCG_TPM=y && HW_RANDOM=m) > > And when IMA=y that does: > > config IMA > bool "Integrity Measurement Architecture(IMA)" > ... > select TCG_TPM if HAS_IOMEM > > And `select` will force the target to the same value as this option. > > TCG_TPM is tri-state (n,y,m) but IMA is boolean (n,y) so this select > forces TCG_TPM=y. > > so !(TCG_TPM=y && HW_RANDOM=m) is true and therefore HW_RANDOM_TPM is > not set. > > $ grep -rnE 'CONFIG_(IMA|TCG_TPM|HW_RANDOM)=' debian/config /boot/config-6.1.0-11-amd64 > debian/config/config:457:CONFIG_HW_RANDOM=m > debian/config/config:7752:CONFIG_IMA=y > debian/config/arm64/config:172:CONFIG_TCG_TPM=m > debian/config/kernelarch-x86/config:332:CONFIG_TCG_TPM=m > debian/config/config.cloud:149:CONFIG_TCG_TPM=m > /boot/config-6.1.0-11-amd64:4324:CONFIG_HW_RANDOM=m > /boot/config-6.1.0-11-amd64:4352:CONFIG_TCG_TPM=y > /boot/config-6.1.0-11-amd64:9774:CONFIG_IMA=y The issue is handled already in #1041007, so merging both. There is a MR to get the change first in unstable: https://salsa.debian.org/kernel-team/linux/-/merge_requests/821 after that it can go into bookworm (likely in the next bookworm point release). Regards, Salvatore
[toc] | [prev] | [next] | [standalone]
| From | "Debian Bug Tracking System" <owner@bugs.debian.org> |
|---|---|
| Date | 2023-09-14 07:10 +0200 |
| Subject | Bug#1051535: marked as done (linux: HW_RANDOM_TPM disabled due to IMA=y) |
| Message-ID | <HdMM1-8RI1-11@gated-at.bofh.it> |
| In reply to | #80345 |
[Multipart message — attachments visible in raw view] — view raw
Your message dated Thu, 14 Sep 2023 05:00:10 +0000 with message-id <E1qgeSY-003Ngv-O1@fasolo.debian.org> and subject line Bug#1041007: fixed in linux 6.5.3-1 has caused the Debian Bug report #1041007, regarding linux: HW_RANDOM_TPM disabled due to IMA=y to be marked as done. This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact owner@bugs.debian.org immediately.) -- 1041007: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1041007 Debian Bug Tracking System Contact owner@bugs.debian.org with problems
[toc] | [prev] | [standalone]
Back to top | Article view | linux.debian.kernel
csiph-web