Bug 786837

Summary:

rngd does not check status when communicating with the TPM

Product:

Red Hat Enterprise Linux 6

Reporter:

Steve Grubb <sgrubb>

Component:

rng-tools

Assignee:

Neil Horman <nhorman>

Status:

CLOSED INSUFFICIENT_DATA

QA Contact:

Rachel Sibley <rasibley>

Severity:

medium

Docs Contact:

Priority:

low

Version:

6.5

CC:

pvrabec

Target Milestone:

Target Release:

---

Hardware:

All

OS:

Linux

Whiteboard:

Fixed In Version:

Doc Type:

Bug Fix

Doc Text:

Story Points:

---

Clone Of:

Environment:

Last Closed:

2015-06-11 16:58:19 UTC

Type:

---

Regression:

---

Mount Type:

---

Documentation:

---

CRM:

Verified Versions:

Category:

---

oVirt Team:

---

RHEL 7.3 requirements from Atomic Host:

Cloudforms Team:

---

Target Upstream Version:

Attachments:

Description	Flags
patch to check tpm return code	none

Description Steve Grubb 2012-02-02 14:39:12 UTC

Description of problem:
Rngd does not interpret any error returns from the TPM chip. In the BIOS, usually you have to do 2 things to get the TPM fully enabled. If you only enable TPM without also setting the "Execute TPM command" to enabled, it can show up as /dev/tpm but doesn't actually work. The program as written does not check the payload returned from the chip for success/failure. It assumes that it was successful and then goes on to do the FIPS test and fails that. So, the only indication is failing a FIPS check rather than saying that the TPM returned an error code and what that error code means.

Comment 3 Suzanne Logcher 2012-02-14 23:30:21 UTC

This request was evaluated by Red Hat Product Management for
inclusion in the current release of Red Hat Enterprise Linux.
Because the affected component is not scheduled to be updated
in the current release, Red Hat is unfortunately unable to
address this request at this time. Red Hat invites you to
ask your support representative to propose this request, if
appropriate and relevant, in the next release of Red Hat
Enterprise Linux. If you would like it considered as an
exception in the current release, please ask your support
representative.

Comment 4 Jeff Garzik 2013-04-18 22:52:34 UTC

Example of checking TPM error return?

Comment 5 Neil Horman 2014-08-13 13:32:53 UTC

This already works in RHEL7 because the kernel handles abstracting the tpm rng.  Basically the tpm response has an ouput header with error code information in it for the GetRandom Command, documented here:

http://www.trustedcomputinggroup.org/files/static_page_files/72C33D71-1A4B-B294-D02C7DF86630BE7C/TPM%20Main-Part%203%20Commands_v1.2_rev116_01032011.pdf

Since RHEL6 does the tpm rng work in rngd, we need to do the same error checking there.

Comment 6 Neil Horman 2014-08-13 15:30:49 UTC

Created attachment 926487 [details]
patch to check tpm return code

test patch to check tpm output header for positive return code.  currently untested

Comment 7 Neil Horman 2014-08-13 15:32:45 UTC

http://brewweb.devel.redhat.com/brew/taskinfo?taskID=7839469

Steve, theres a test build with the patch from the previous comment included.  If you could please test it out and let me know if it works, I would appreciate it

Comment 8 Neil Horman 2015-06-11 16:58:19 UTC

Closing, its been a year without any feedback here.