Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1555834

Re: [PATCH RFC 0/4] RFC: in-kernel resource manager

From Ken Goldman <kgoldman@us.ibm.com>
Newsgroups linux.kernel
Subject Re: [PATCH RFC 0/4] RFC: in-kernel resource manager
Date 2017-01-10 20:20 +0100
Message-ID <sYa7D-5fe-15@gated-at.bofh.it> (permalink)
References <sVaQx-7mn-5@gated-at.bofh.it> <sWiM1-5ja-11@gated-at.bofh.it> <sWk1s-63E-21@gated-at.bofh.it> <sWl7c-6J7-37@gated-at.bofh.it> <sWmmB-7rW-1@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw

On 1/5/2017 2:20 PM, Jason Gunthorpe wrote:
>
> I'd rather give up features (eg policy sessions, if necessary) for the
> unpriv fd than give up security of the unpriv fd.

Please don't give up policy.  Nearly every use case of that we think of 
for TPM 2.0 uses policy sessions.

E.g.,

In 1.2, PCR authorization was built in to the object.  In 2.0, it's a 
policy.

In 1.2, key types were restricted to certain commands.  In 2.0, it's a 
policy.

Then there are all the new use cases - time restricted keys, use count 
restricted keys, keys with a PIN, etc., all use policy.

Even use of the EK primary key requires a policy, and that's needed for 
salt (getting the first password in securely) and attestation (proof 
that the TPM is authentic).

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

RE: [tpmdd-devel] [PATCH RFC 0/4] RFC: in-kernel resource manager "Fuchs, Andreas" <andreas.fuchs@sit.fraunhofer.de> - 2017-01-05 17:10 +0100
  Re: [tpmdd-devel] [PATCH RFC 0/4] RFC: in-kernel resource manager Jason Gunthorpe <jgunthorpe@obsidianresearch.com> - 2017-01-05 18:30 +0100
    Re: [tpmdd-devel] [PATCH RFC 0/4] RFC: in-kernel resource manager James Bottomley <jejb@linux.vnet.ibm.com> - 2017-01-05 19:10 +0100
      Re: [tpmdd-devel] [PATCH RFC 0/4] RFC: in-kernel resource manager Andreas Fuchs <andreas.fuchs@sit.fraunhofer.de> - 2017-01-06 09:50 +0100
    Re: [tpmdd-devel] [PATCH RFC 0/4] RFC: in-kernel resource manager James Bottomley <jejb@linux.vnet.ibm.com> - 2017-01-05 19:40 +0100
      Re: [tpmdd-devel] [PATCH RFC 0/4] RFC: in-kernel resource manager Jason Gunthorpe <jgunthorpe@obsidianresearch.com> - 2017-01-05 21:00 +0100
        Re: [tpmdd-devel] [PATCH RFC 0/4] RFC: in-kernel resource manager James Bottomley <jejb@linux.vnet.ibm.com> - 2017-01-05 21:00 +0100
          Re: [tpmdd-devel] [PATCH RFC 0/4] RFC: in-kernel resource manager Jason Gunthorpe <jgunthorpe@obsidianresearch.com> - 2017-01-05 23:30 +0100
            Re: [tpmdd-devel] [PATCH RFC 0/4] RFC: in-kernel resource manager Jason Gunthorpe <jgunthorpe@obsidianresearch.com> - 2017-01-06 01:00 +0100
              Re: [tpmdd-devel] [PATCH RFC 0/4] RFC: in-kernel resource manager James Bottomley <jejb@linux.vnet.ibm.com> - 2017-01-06 01:40 +0100
                Re: [tpmdd-devel] [PATCH RFC 0/4] RFC: in-kernel resource manager Andreas Fuchs <andreas.fuchs@sit.fraunhofer.de> - 2017-01-06 10:10 +0100
                Re: [tpmdd-devel] [PATCH RFC 0/4] RFC: in-kernel resource manager Jason Gunthorpe <jgunthorpe@obsidianresearch.com> - 2017-01-06 20:20 +0100
                Re: [tpmdd-devel] [PATCH RFC 0/4] RFC: in-kernel resource manager Jason Gunthorpe <jgunthorpe@obsidianresearch.com> - 2017-01-06 20:10 +0100
            Re: [tpmdd-devel] [PATCH RFC 0/4] RFC: in-kernel resource manager James Bottomley <jejb@linux.vnet.ibm.com> - 2017-01-06 02:40 +0100
        Re: [PATCH RFC 0/4] RFC: in-kernel resource manager Ken Goldman <kgoldman@us.ibm.com> - 2017-01-10 20:20 +0100
  Re: [tpmdd-devel] [PATCH RFC 0/4] RFC: in-kernel resource manager Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> - 2017-01-09 23:40 +0100
    Re: [tpmdd-devel] [PATCH RFC 0/4] RFC: in-kernel resource manager Andreas Fuchs <andreas.fuchs@sit.fraunhofer.de> - 2017-01-11 11:10 +0100

csiph-web