Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Enable hex values to be used for tpm_ownerpassword #769

Merged
merged 1 commit into from
Apr 26, 2024
Merged

Enable hex values to be used for tpm_ownerpassword #769

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions keylime-agent.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -263,6 +263,9 @@ idevid_cert = "default"
# Use this option to state the existing TPM ownerpassword.
# This option should be set only when a password is set for the Endorsement
# Hierarchy (e.g. via "tpm2_changeauth -c e").
# In order to use a hex value for the password, use the prefix "hex:"
# For example if tpm2_changeauth -c e "hex:00a1b2c3e4" has run, the config option
# would be 'tpm_ownerpassword = "hex:00a1b2c3e4"'
# If no password was set, keep the empty string "".
#
# To override tpm_ownerpassword, set KEYLIME_AGENT_TPM_OWNERPASSWORD environment
Expand Down
10 changes: 9 additions & 1 deletion keylime-agent/src/main.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -295,7 +295,15 @@
// ownership of TPM access, which will not be implemented here.
let tpm_ownerpassword = &config.agent.tpm_ownerpassword;
if !tpm_ownerpassword.is_empty() {
let auth = Auth::try_from(tpm_ownerpassword.as_bytes())?;
let auth = if let Some(hex_ownerpassword) =

Check warning on line 298 in keylime-agent/src/main.rs

View check run for this annotation

Codecov / codecov/patch

keylime-agent/src/main.rs#L298 

Added line #L298 was not covered by tests
tpm_ownerpassword.strip_prefix("hex:")
{
let decoded_ownerpassword =

Check warning on line 301 in keylime-agent/src/main.rs

View check run for this annotation

Codecov / codecov/patch

keylime-agent/src/main.rs#L301 

Added line #L301 was not covered by tests
hex::decode(hex_ownerpassword).map_err(Error::from)?;
Auth::try_from(decoded_ownerpassword)?

Check warning on line 303 in keylime-agent/src/main.rs

View check run for this annotation

Codecov / codecov/patch

keylime-agent/src/main.rs#L303 

Added line #L303 was not covered by tests
} else {
Auth::try_from(tpm_ownerpassword.as_bytes())?

Check warning on line 305 in keylime-agent/src/main.rs

View check run for this annotation

Codecov / codecov/patch

keylime-agent/src/main.rs#L305 

Added line #L305 was not covered by tests
};
ctx.as_mut().tr_set_auth(Hierarchy::Endorsement.into(), auth)
.map_err(|e| {
Error::Configuration(format!(
Expand Down