Skip to content

Commit c325e00

Browse files
maugustosilvamaugustosilva
authored
Merge pull request keylime#957 from THS-on/remove-stub-support
Remove stubbing support for TPM, VTPM and IMA
2 parents d267003 + 48eed74 commit c325e00

File tree

8 files changed

+9
-351
lines changed

8 files changed

+9
-351
lines changed

‎doc/stub-tpm-notes.md‎

Lines changed: 0 additions & 67 deletions
This file was deleted.

‎keylime/config.py‎

Lines changed: 1 addition & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -22,8 +22,6 @@
2222
from yaml import SafeLoader
2323
from yaml.reader import ReaderError
2424

25-
from keylime import json
26-
2725

2826
def convert(data):
2927
if isinstance(data, bytes):
@@ -50,22 +48,6 @@ def environ_bool(env_name, default):
5048
f"{val} (use either on/true/1 or off/false/0)")
5149

5250

53-
# SET STUB_TPM TO True TO ALLOW ALL TPM Operations to be stubbed out
54-
# If STUB_TPM=True, TPM_CANNED_VALUES_PATH file must be provided (canned inputs)
55-
# Canned input values can be generated by running with STUB_TPM=False and
56-
# specifying a TPM_CANNED_VALUES_PATH filename
57-
STUB_TPM = False
58-
TPM_CANNED_VALUES_PATH = None
59-
60-
# SET TO TRUE TO STUB A VTPM
61-
STUB_VTPM = False
62-
# force stub tpm if vtpm true
63-
if STUB_VTPM:
64-
STUB_TPM = True
65-
66-
# Enable TPM benchmarking (output timing data to given file)
67-
TPM_BENCHMARK_PATH = None
68-
6951
# set to False to enable keylime to run from the CWD and not require
7052
# root access. for testing purposes only
7153
# all processes will log to the CWD in keylime-all.log
@@ -77,12 +59,6 @@ def environ_bool(env_name, default):
7759
# allow the emuatlor to not have an ekcert even if check ekcert is true
7860
DISABLE_EK_CERT_CHECK_EMULATOR = False
7961

80-
# stub out IMA functionality
81-
STUB_IMA = False
82-
83-
if STUB_TPM:
84-
STUB_IMA = True
85-
8662
# allow testing mode
8763
TEST_MODE = os.getenv('KEYLIME_TEST', 'False')
8864
if TEST_MODE.upper() == 'TRUE':
@@ -93,19 +69,6 @@ def environ_bool(env_name, default):
9369
# whether to use tpmfs or not
9470
MOUNT_SECURE = True
9571

96-
# load in JSON canned values if we're in stub mode (and JSON file given)
97-
TPM_CANNED_VALUES = None
98-
if STUB_TPM and TPM_CANNED_VALUES_PATH is not None:
99-
with open(TPM_CANNED_VALUES_PATH, "rb") as can:
100-
print(f"WARNING: using canned values in stub mode from file '{TPM_CANNED_VALUES_PATH}'")
101-
# Read in JSON and strip trailing extraneous commas
102-
jsonInTxt = can.read().rstrip(',\r\n')
103-
# Saved JSON is missing surrounding braces, so add them here
104-
TPM_CANNED_VALUES = json.loads('{' + jsonInTxt + '}')
105-
elif STUB_TPM:
106-
raise Exception(
107-
'STUB_TPM=True but required TPM_CANNED_VALUES_PATH not provided!')
108-
10972

11073
if not REQUIRE_ROOT:
11174
MOUNT_SECURE = False
@@ -174,10 +137,7 @@ def yaml_to_dict(arry, add_newlines=True, logger=None) -> Optional[dict]:
174137
return None
175138

176139

177-
if STUB_IMA:
178-
IMA_ML = '../scripts/ima/ascii_runtime_measurements'
179-
else:
180-
IMA_ML = '/sys/kernel/security/ima/ascii_runtime_measurements'
140+
IMA_ML = '/sys/kernel/security/ima/ascii_runtime_measurements'
181141

182142
IMA_PCR = 10
183143

‎keylime/ima.py‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -393,8 +393,6 @@ def process_allowlists(allowlist, exclude):
393393
def read_allowlist(al_path=None, checksum="", gpg_sig_file=None, gpg_key_file=None):
394394
if al_path is None:
395395
al_path = config.get('tenant', 'ima_allowlist')
396-
if config.STUB_IMA:
397-
al_path = '../scripts/ima/allowlist.txt'
398396

399397
# If user only wants signatures then an allowlist is not required
400398
if al_path is None or al_path == '':
@@ -483,8 +481,6 @@ def read_allowlist(al_path=None, checksum="", gpg_sig_file=None, gpg_key_file=No
483481
def read_excllist(exclude_path=None):
484482
if exclude_path is None:
485483
exclude_path = config.get('tenant', 'ima_excludelist')
486-
if config.STUB_IMA:
487-
exclude_path = '../scripts/ima/exclude.txt'
488484

489485
excl_list = []
490486
if os.path.exists(exclude_path):

‎keylime/keylime_agent.py‎

Lines changed: 0 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -738,16 +738,6 @@ def main():
738738
if not validators.valid_agent_id(agent_uuid):
739739
raise RuntimeError("The agent ID set via agent uuid parameter use invalid characters")
740740

741-
if config.STUB_VTPM and config.TPM_CANNED_VALUES is not None:
742-
# Use canned values for stubbing
743-
jsonIn = config.TPM_CANNED_VALUES
744-
if "add_vtpm_to_group" in jsonIn:
745-
# The value we're looking for has been canned!
746-
agent_uuid = jsonIn['add_vtpm_to_group']['retout']
747-
else:
748-
# Our command hasn't been canned!
749-
raise Exception("Command add_vtpm_to_group not found in canned json!")
750-
751741
logger.info("Agent UUID: %s", agent_uuid)
752742

753743
serveraddr = (config.get('cloud_agent', 'cloudagent_ip'),

‎keylime/registrar_common.py‎

Lines changed: 4 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,6 @@
2121
from keylime.common import validators
2222
from keylime.db.registrar_db import RegistrarMain
2323
from keylime.db.keylime_db import DBEngineManager, SessionManager
24-
from keylime import config
2524
from keylime import crypto
2625
from keylime import json
2726
from keylime.tpm import tpm2_objects
@@ -466,7 +465,8 @@ def do_PUT(self):
466465
logger.error('SQLAlchemy Error: %s', e)
467466
raise
468467

469-
if config.STUB_TPM:
468+
ex_mac = crypto.do_hmac(agent.key.encode(), agent_id)
469+
if ex_mac == auth_tag:
470470
try:
471471
session.query(RegistrarMain).filter(RegistrarMain.agent_id == agent_id).update(
472472
{'active': int(True)})
@@ -475,18 +475,8 @@ def do_PUT(self):
475475
logger.error('SQLAlchemy Error: %s', e)
476476
raise
477477
else:
478-
ex_mac = crypto.do_hmac(agent.key.encode(), agent_id)
479-
if ex_mac == auth_tag:
480-
try:
481-
session.query(RegistrarMain).filter(RegistrarMain.agent_id == agent_id).update(
482-
{'active': int(True)})
483-
session.commit()
484-
except SQLAlchemyError as e:
485-
logger.error('SQLAlchemy Error: %s', e)
486-
raise
487-
else:
488-
raise Exception(
489-
f"Auth tag {auth_tag} does not match expected value {ex_mac}")
478+
raise Exception(
479+
f"Auth tag {auth_tag} does not match expected value {ex_mac}")
490480

491481
web_util.echo_json_response(self, 200, "Success")
492482
logger.info('PUT activated: %s', agent_id)

‎keylime/tenant.py‎

Lines changed: 2 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -532,9 +532,7 @@ def check_ek(self, ekcert):
532532
[type] -- [description]
533533
"""
534534
if config.getboolean('tenant', 'require_ek_cert'):
535-
if config.STUB_TPM:
536-
logger.debug("Not checking ekcert due to STUB_TPM mode")
537-
elif ekcert == 'emulator' and config.DISABLE_EK_CERT_CHECK_EMULATOR:
535+
if ekcert == 'emulator' and config.DISABLE_EK_CERT_CHECK_EMULATOR:
538536
logger.info("Not checking ekcert of TPM emulator")
539537
elif ekcert is None:
540538
logger.warning("No EK cert provided, require_ek_cert option in config set to True")
@@ -576,7 +574,7 @@ def validate_tpm_quote(self, public_key, quote, hash_alg):
576574
if self.registrar_data['regcount'] > 1:
577575
logger.warning("WARNING: This UUID had more than one ek-ekcert registered to it! This might indicate that your system is misconfigured. Run 'regdelete' for this agent and restart")
578576

579-
if not config.STUB_TPM and (not config.getboolean('tenant', 'require_ek_cert') and config.get('tenant', 'ek_check_script') == ""):
577+
if not config.getboolean('tenant', 'require_ek_cert') and config.get('tenant', 'ek_check_script') == "":
580578
logger.warning(
581579
"DANGER: EK cert checking is disabled and no additional checks on EKs have been specified with ek_check_script option. Keylime is not secure!!")
582580

@@ -1355,15 +1353,6 @@ def main(argv=sys.argv): #pylint: disable=dangerous-default-value
13551353
logger.warning("Using default UUID d432fbb3-d2f1-4a97-9ef7-75bd81c00000")
13561354
mytenant.agent_uuid = "d432fbb3-d2f1-4a97-9ef7-75bd81c00000"
13571355

1358-
if config.STUB_VTPM and config.TPM_CANNED_VALUES is not None:
1359-
# Use canned values for agent UUID
1360-
jsonIn = config.TPM_CANNED_VALUES
1361-
if "add_vtpm_to_group" in jsonIn:
1362-
mytenant.agent_uuid = jsonIn['add_vtpm_to_group']['retout']
1363-
else:
1364-
# Our command hasn't been canned!
1365-
raise UserError("Command add_vtpm_to_group not found in canned JSON!")
1366-
13671356
if args.verifier_id is not None:
13681357
mytenant.verifier_id = args.verifier_id
13691358
if args.verifier_ip is not None:

‎keylime/tpm/tpm_abstract.py‎

Lines changed: 0 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -202,9 +202,6 @@ def __check_ima(agentAttestState, pcrval, ima_measurement_list, allowlist,
202202
ima_keyrings, boot_aggregates, hash_alg):
203203
failure = Failure(Component.IMA)
204204
logger.info("Checking IMA measurement list on agent: %s", agentAttestState.get_agent_id())
205-
if config.STUB_IMA:
206-
pcrval = None
207-
208205
_, ima_failure = ima.process_measurement_list(agentAttestState, ima_measurement_list.split('\n'), allowlist,
209206
pcrval=pcrval, ima_keyrings=ima_keyrings,
210207
boot_aggregates=boot_aggregates, hash_alg=hash_alg)
@@ -253,10 +250,6 @@ def check_pcrs(self, agentAttestState, tpm_policy, pcrs, data, virtual, ima_meas
253250
pcrs = AbstractTPM.__parse_pcrs(pcrs, virtual)
254251
pcr_nums = set(pcrs.keys())
255252

256-
# Skip validation if TPM is stubbed.
257-
if config.STUB_TPM:
258-
return failure
259-
260253
# Validate data PCR
261254
if config.TPM_DATA_PCR in pcr_nums and data is not None:
262255
expectedval = self.sim_extend(data, hash_alg=hash_alg)

0 commit comments

Comments
 (0)