Hide Forgot
Description of problem: Rngd does not interpret any error returns from the TPM chip. In the BIOS, usually you have to do 2 things to get the TPM fully enabled. If you only enable TPM without also setting the "Execute TPM command" to enabled, it can show up as /dev/tpm but doesn't actually work. The program as written does not check the payload returned from the chip for success/failure. It assumes that it was successful and then goes on to do the FIPS test and fails that. So, the only indication is failing a FIPS check rather than saying that the TPM returned an error code and what that error code means.
This request was evaluated by Red Hat Product Management for inclusion in the current release of Red Hat Enterprise Linux. Because the affected component is not scheduled to be updated in the current release, Red Hat is unfortunately unable to address this request at this time. Red Hat invites you to ask your support representative to propose this request, if appropriate and relevant, in the next release of Red Hat Enterprise Linux. If you would like it considered as an exception in the current release, please ask your support representative.
Example of checking TPM error return?
This already works in RHEL7 because the kernel handles abstracting the tpm rng. Basically the tpm response has an ouput header with error code information in it for the GetRandom Command, documented here: http://www.trustedcomputinggroup.org/files/static_page_files/72C33D71-1A4B-B294-D02C7DF86630BE7C/TPM%20Main-Part%203%20Commands_v1.2_rev116_01032011.pdf Since RHEL6 does the tpm rng work in rngd, we need to do the same error checking there.
Created attachment 926487 [details] patch to check tpm return code test patch to check tpm output header for positive return code. currently untested
http://brewweb.devel.redhat.com/brew/taskinfo?taskID=7839469 Steve, theres a test build with the patch from the previous comment included. If you could please test it out and let me know if it works, I would appreciate it
Closing, its been a year without any feedback here.