Roberto Sassu 2d6c25215a KEYS: trusted: allow module init if TPM is inactive or deactivated ... Commit c78719203f ("KEYS: trusted: allow trusted.ko to initialize w/o a TPM") allows the trusted module to be loaded even if a TPM is not found, to avoid module dependency problems. However, trusted module initialization can still fail if the TPM is inactive or deactivated. tpm_get_random() returns an error. This patch removes the call to tpm_get_random() and instead extends the PCR specified by the user with zeros. The security of this alternative is equivalent to the previous one, as either option prevents with a PCR update unsealing and misuse of sealed data by a user space process. Even if a PCR is extended with zeros, instead of random data, it is still computationally infeasible to find a value as input for a new PCR extend operation, to obtain again the PCR value that would allow unsealing. Cc: stable@vger.kernel.org Fixes: 240730437d ("KEYS: trusted: explicitly use tpm_chip structure...") Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com> Reviewed-by: Tyler Hicks <tyhicks@canonical.com> Suggested-by: Mimi Zohar <zohar@linux.ibm.com> Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>		2019-08-13 19:59:23 +03:00
..
apparmor	Merge branch 'work.mount0' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2019-07-19 10:42:02 -07:00
integrity	Revert "Merge tag 'keys-acl-20190703' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs"	2019-07-10 18:43:43 -07:00
keys	KEYS: trusted: allow module init if TPM is inactive or deactivated	2019-08-13 19:59:23 +03:00
loadpin	proc/sysctl: add shared variables for range check	2019-07-18 17:08:07 -07:00
safesetid	LSM: SafeSetID: fix use of literal -1 in capable hook	2019-07-15 08:08:03 -07:00
selinux	selinux/stable-5.3 PR 20190801	2019-08-02 18:40:49 -07:00
smack	Merge branch 'work.mount0' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2019-07-19 10:42:02 -07:00
tomoyo	treewide: Add SPDX license identifier - Makefile/Kconfig	2019-05-21 10:50:46 +02:00
yama	proc/sysctl: add shared variables for range check	2019-07-18 17:08:07 -07:00
Kconfig	docs: x86: move two x86-specific files to x86 arch dir	2019-07-15 11:03:01 -03:00
Kconfig.hardening	meminit fix	2019-07-28 12:33:15 -07:00
Makefile	LSM: add SafeSetID module that gates setid calls	2019-01-25 11:22:45 -08:00
commoncap.c	Merge branch 'next-lsm' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security	2019-07-09 12:24:21 -07:00
device_cgroup.c	docs: cgroup-v1: add it to the admin-guide book	2019-07-15 11:03:02 -03:00
inode.c	Merge branch 'work.mount0' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2019-07-19 10:42:02 -07:00
lsm_audit.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500	2019-06-19 17:09:55 +02:00
min_addr.c	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
security.c	Merge branch 'next-integrity' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity	2019-07-08 20:28:59 -07:00