Re: [PATCH v4 2/2] selftests: tpm2: Reset the dictionary attack lock

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 




On 11/29/21 18:43, Jarkko Sakkinen wrote:
On Sat, Nov 27, 2021 at 11:10:52PM -0500, Stefan Berger wrote:
From: Stefan Berger <stefanb@xxxxxxxxxxxxx>

Reset the dictionary attack lock to avoid the following types of test
failures after running the test 2 times:

======================================================================
ERROR: test_unseal_with_wrong_policy (tpm2_tests.SmokeTest)
----------------------------------------------------------------------
Traceback (most recent call last):
   File "/root/linux-ima-namespaces/tools/testing/selftests/tpm2/tpm2_tests.py", line 105, in test_unseal_with_wrong_policy
     blob = self.client.seal(self.root_key, data, auth, policy_dig)
   File "/root/linux-ima-namespaces/tools/testing/selftests/tpm2/tpm2.py", line 620, in seal
     rsp = self.send_cmd(cmd)
   File "/root/linux-ima-namespaces/tools/testing/selftests/tpm2/tpm2.py", line 397, in send_cmd
     raise ProtocolError(cc, rc)
tpm2.ProtocolError: TPM_RC_LOCKOUT: cc=0x00000153, rc=0x00000921

Signed-off-by: Stefan Berger <stefanb@xxxxxxxxxxxxx>
---
  tools/testing/selftests/tpm2/tpm2_tests.py | 2 ++
  1 file changed, 2 insertions(+)

diff --git a/tools/testing/selftests/tpm2/tpm2_tests.py b/tools/testing/selftests/tpm2/tpm2_tests.py
index e63a37819978..ad6f54c01adf 100644
--- a/tools/testing/selftests/tpm2/tpm2_tests.py
+++ b/tools/testing/selftests/tpm2/tpm2_tests.py
@@ -139,6 +139,8 @@ class SmokeTest(unittest.TestCase):
          except:
              self.client.flush_context(handle)
              raise
+        finally:
+            self.client.reset_da_lock()
self.assertEqual(rc, tpm2.TPM2_RC_POLICY_FAIL) --
2.31.1

I don't agree with this as a DA lock has legit use. This would be adequate
for systems dedicated for kernel testing only.

The problem is this particular test case I am patching here causes the above test failures upon rerun. We are testing the driver here presumably and not the TPM2, so I think we should leave the TPM2 as cleaned up as possible, thus my suggestion is to reset the DA lock and we won't hear any complaints after that.


We could make this available in the folder where TPM2 tests are:

https://git.kernel.org/pub/scm/linux/kernel/git/jarkko/tpm2-scripts.git/tree/tpm2-reset-da-lock


The tss packages also have command line tools to reset the DA lock, but it shouldn't be necessary to use them after running a **driver** test case.


   stefan



/Jarkko



[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux Kernel]     [Linux Kernel Hardening]     [Linux NFS]     [Linux NILFS]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Yosemite News]     [Linux SCSI]

  Powered by Linux