On Sat, Jan 14, 2023 at 9:05 PM Matthew Garrett <mgarrett@xxxxxxxxxxx> wrote: > > On Sat, Jan 14, 2023 at 6:55 AM James Bottomley <jejb@xxxxxxxxxxxxx> wrote: > > Can we go back again to why you can't use locality? It's exactly > > designed for this since locality is part of creation data. Currently > > everything only uses locality 0, so it's impossible for anyone on Linux > > to produce a key with anything other than 0 in the creation data for > > locality. However, the dynamic launch people are proposing that the > > Kernel should use Locality 2 for all its operations, which would allow > > you to distinguish a key created by the kernel from one created by a > > user by locality. > > > > I think the previous objection was that not all TPMs implement > > locality, but then not all laptops have TPMs either, so if you ever > > come across one which has a TPM but no locality, it's in a very similar > > security boat to one which has no TPM. > > It's not a question of TPM support, it's a question of platform > support. Intel chipsets that don't support TXT simply don't forward > requests with non-0 locality. Every Windows-sticker laptop since 2014 > has shipped with a TPM, but the number that ship with TXT support is a > very small percentage of that. I agree that locality is the obvious > solution for a whole bunch of problems, but it's just not usable in > the generic case. Instead of walling off a PCR, why not wall off an NV Index PCR and use a policy?
