Comments (6)
Hi @IldarAbdullin-okta ,
No plans currently. What is the use-case and platform where you need this feature?
If you are on Linux we support --enable-tislock
or WOLFTPM_TIS_LOCK
that uses a named semaphore for locking allowing concurrent access between processes. However that only works if using our TIS layer. If using the /dev/tpm0 it's handled by the Linux Kernel.
Thanks,
David Garske, wolfSSL
from wolftpm.
Hi @IldarAbdullin-okta ,
No plans currently. What is the use-case and platform where you need this feature?
If you are on Linux we support
--enable-tislock
orWOLFTPM_TIS_LOCK
that uses a named semaphore for locking allowing concurrent access between processes. However that only works if using our TIS layer. If using the /dev/tpm0 it's handled by the Linux Kernel.Thanks, David Garske, wolfSSL
Platform is Linux, and yes, we are using /dev/tpm0 interface. One of the concern with the approach is that communication with /dev/tpmX requires root privileges. As a workaround we are thinking about installing udev rule similar to - tpm2-tss tool approach and add an end user to TSS group.
As a workaround we can have KERNEL=="tpm[0-9]*", TAG+="systemd", MODE="0660", GROUP="tss"
, and this most likely will be our short term solution. However that rule can be overwritten if user will install tpm2-tss tool after our application. So for us it would be great if we can follow the same approach as TSS has today for their tpm tools
from wolftpm.
Hi @IldarAbdullin-okta ,
Thank you for those details. I will look into this TSS approach and see if I can improve wolfTPM support.
Thanks,
David Garske, wolfSSL
from wolftpm.
Hi @IldarAbdullin-okta , I posted instructions for setting up a custom group and Udev rules. See https://github.com/wolfSSL/wolfTPM/pull/366/files#diff-b335630551682c19a781afebcf4d07bf978fb1f8ac04c6bf87428ed5106870f5R273
from wolftpm.
Hi @IldarAbdullin-okta , I posted instructions for setting up a custom group and Udev rules. See https://github.com/wolfSSL/wolfTPM/pull/366/files#diff-b335630551682c19a781afebcf4d07bf978fb1f8ac04c6bf87428ed5106870f5R273
Hi @dgarske ,
Thanks for updating instructions! New changes look good to me. One thing is that sudo udevadm control -R
doesn't help and you still have to logout or reboot(tested on Ubuntu 22+). I didn't find a good way how to make it work without reboot. Most likely that requires reload of a TPM driver
Also checking regarding tpmrmX integration again. I'm hearing feedback that integration against tpmrmX may help against apps that are trying to DoS TPM with a lot of requests.
Ildar
from wolftpm.
Hi @IldarAbdullin-okta , I posted instructions for setting up a custom group and Udev rules. See https://github.com/wolfSSL/wolfTPM/pull/366/files#diff-b335630551682c19a781afebcf4d07bf978fb1f8ac04c6bf87428ed5106870f5R273
Hi @dgarske ,
Thanks for updating instructions! New changes look good to me. One thing is that
sudo udevadm control -R
doesn't help and you still have to logout or reboot(tested on Ubuntu 22+). I didn't find a good way how to make it work without reboot. Most likely that requires reload of a TPM driverAlso checking regarding tpmrmX integration again. I'm hearing feedback that integration against tpmrmX may help against apps that are trying to DoS TPM with a lot of requests.
Ildar
I noticed that too about having to reboot. I will update the instructions.
from wolftpm.
Related Issues (20)
- Can't clear TPM chip HOT 2
- git commit fails even though no change was made HOT 3
- Build errors
- wolftpm C# wrapper needs to implement IDisposable instead of using Finalizer. HOT 2
- Error handling in C# wrapper HOT 2
- Fix the maximum clock speed for SLB9672
- wolfTPM is not thread-safe (`gActiveTPM` ought to be a thread-local) HOT 5
- Add more examples: TPM2_ActivateCredential() HOT 1
- Software-only implementations of TPM2_Duplicate() and TPM2_MakeCredential() HOT 1
- Response to TCG TPM2.0 Errata ID: TCGVRT0007 and CVE-2023-1017 and CVE-2023-1018 HOT 1
- How to go through wolfTPM2_Init with gdb HOT 7
- Building in MSYS2: undefined reference to `__imp_wolfSSL.._ HOT 10
- keygen -rsa -eh failed with TPM_RC_BAD_AUTH HOT 7
- Stuck in TPM2_Startup(&startupIn) function HOT 11
- Windows/WSL Problem with .git/hooks/pre-commit zero-length file
- Is 1,000,000 a reasonable value for TPM_TIMEOUT_TRIES? HOT 2
- P-256K1 support in the TCG standards HOT 7
- tpm2_linux open() file descriptor 0 should be allowed HOT 2
- Need help - can't decrypt data using wolfTPM2_RsaDecrypt HOT 3
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from wolftpm.