Skip to content

Conversation

@Isaac-Matthews
Copy link
Contributor

This PR adds into the config the ability to specify handles and auth values for IDevID and IAK keys. The auth values function in the same way as the TPM ownerpassword in that they can be hex values.

The new config options are:

idevid_password = ""
idevid_handle = ""

iak_password = ""
iak_handle = ""

@Isaac-Matthews
Copy link
Contributor Author

/packit retest-failed

@Isaac-Matthews Isaac-Matthews force-pushed the handles_auth_for_idevid branch from d1372d0 to a0035d8 Compare May 22, 2024 11:18
@ansasaki ansasaki added Keylime general Involves Python codebase configuration Involves changes to configuration file format labels May 29, 2024
///
/// # Return
/// The corresponding KeyHandle, or a TPMError
pub fn get_key_handle(
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I see you declared this method as public, but it is currently only used to get the handles for IDevID and IAK keys.

Do you see future usage of this in other use case? If not, could you make it private by removing the pub keyword?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I thought it could be a useful method but did not have a specific use-case in mind. I'll change to private and we can always change back to public if we want to use it in future.

# Alternatively if the keys are persisted, provide the handles for their location below, and optionally their passwords.
# If handles are provided, they will take priority over templates/algorithms selected above.
# To use a hex password, use the prefix "hex:" at the start of the password.
idevid_password = ""
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Since you are adding new configuration options, do not forget to make a PR to add the configuration files to the configuration upgrade template.

I'll create an issue when we merge this to remind you.

@ansasaki
Copy link
Contributor

@Isaac-Matthews Could you please rebase on top of current master?

Signed-off-by: Isaac-Matthews <isaac.matthews@hpe.com>
@Isaac-Matthews Isaac-Matthews force-pushed the handles_auth_for_idevid branch from a0035d8 to cefe87e Compare May 31, 2024 15:33
Signed-off-by: Isaac-Matthews <isaac.matthews@hpe.com>
@Isaac-Matthews Isaac-Matthews force-pushed the handles_auth_for_idevid branch from cefe87e to 562641c Compare May 31, 2024 15:50
@codecov
Copy link

codecov bot commented May 31, 2024

Codecov Report

Attention: Patch coverage is 28.36879% with 101 lines in your changes are missing coverage. Please review.

Project coverage is 61.26%. Comparing base (2f7b3ad) to head (562641c).
Report is 25 commits behind head on master.

Additional details and impacted files
Flag Coverage Δ
e2e-testsuite 61.26% <28.36%> (+3.67%) ⬆️
upstream-unit-tests 61.26% <28.36%> (+10.25%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files Coverage Δ
keylime-agent/src/config.rs 87.48% <86.95%> (-0.02%) ⬇️
keylime-agent/src/main.rs 26.74% <0.00%> (+0.72%) ⬆️
keylime/src/tpm.rs 66.63% <0.00%> (+0.44%) ⬆️

... and 7 files with indirect coverage changes

Copy link
Contributor

@ansasaki ansasaki left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you for the contribution!

I created RedHat-SP-Security/keylime-tests#587 to track the end-to-end test creation

@ansasaki ansasaki merged commit d027299 into keylime:master Jun 6, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

configuration Involves changes to configuration file format Keylime general Involves Python codebase

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants