Re: [PATCH 5/9] security: keys: trusted: Allow storage of PCR values in creation data

2021-02-21 Thread Matthew Garrett
On Sat, Feb 20, 2021 at 05:09:07AM +0200, Jarkko Sakkinen wrote: > Something popped into mind: could we make PCR 23 reservation dynamic > instead of a config option. > > E.g. if the user space uses it, then it's dirty and hibernate will > fail. I really dislike the static compilation time

Re: [PATCH 5/9] security: keys: trusted: Allow storage of PCR values in creation data

2021-02-21 Thread Ben Boeckel
On Sat, Feb 20, 2021 at 05:09:07 +0200, Jarkko Sakkinen wrote: > Something popped into mind: could we make PCR 23 reservation dynamic > instead of a config option. > > E.g. if the user space uses it, then it's dirty and hibernate will > fail. I really dislike the static compilation time firewall

Re: [PATCH 5/9] security: keys: trusted: Allow storage of PCR values in creation data

2021-02-19 Thread Jarkko Sakkinen
On Sat, Feb 20, 2021 at 01:32:51AM +, Matthew Garrett wrote: > When TPMs generate keys, they can also generate some information > describing the state of the PCRs at creation time. This data can then > later be certified by the TPM, allowing verification of the PCR values. > This allows us to

[PATCH 5/9] security: keys: trusted: Allow storage of PCR values in creation data

2021-02-19 Thread Matthew Garrett
When TPMs generate keys, they can also generate some information describing the state of the PCRs at creation time. This data can then later be certified by the TPM, allowing verification of the PCR values. This allows us to determine the state of the system at the time a key was generated. Add an