mirror of
https://github.com/torvalds/linux.git
synced 2026-10-07 05:31:08 -04:00
Roberto Sassu
2d6c25215a
Commitc78719203f("KEYS: trusted: allow trusted.ko to initialize w/o a TPM") allows the trusted module to be loaded even if a TPM is not found, to avoid module dependency problems. However, trusted module initialization can still fail if the TPM is inactive or deactivated. tpm_get_random() returns an error. This patch removes the call to tpm_get_random() and instead extends the PCR specified by the user with zeros. The security of this alternative is equivalent to the previous one, as either option prevents with a PCR update unsealing and misuse of sealed data by a user space process. Even if a PCR is extended with zeros, instead of random data, it is still computationally infeasible to find a value as input for a new PCR extend operation, to obtain again the PCR value that would allow unsealing. Cc: [email protected] Fixes:240730437d("KEYS: trusted: explicitly use tpm_chip structure...") Signed-off-by: Roberto Sassu <[email protected]> Reviewed-by: Tyler Hicks <[email protected]> Suggested-by: Mimi Zohar <[email protected]> Reviewed-by: Jarkko Sakkinen <[email protected]> Signed-off-by: Jarkko Sakkinen <[email protected]>