Sync from SUSE:SLFO:Main tpm2.0-abrmd revision 613f1638190d809896a915be6acbcd2a
This commit is contained in:
commit
692ed4d24c
23
.gitattributes
vendored
Normal file
23
.gitattributes
vendored
Normal file
@ -0,0 +1,23 @@
|
|||||||
|
## Default LFS
|
||||||
|
*.7z filter=lfs diff=lfs merge=lfs -text
|
||||||
|
*.bsp filter=lfs diff=lfs merge=lfs -text
|
||||||
|
*.bz2 filter=lfs diff=lfs merge=lfs -text
|
||||||
|
*.gem filter=lfs diff=lfs merge=lfs -text
|
||||||
|
*.gz filter=lfs diff=lfs merge=lfs -text
|
||||||
|
*.jar filter=lfs diff=lfs merge=lfs -text
|
||||||
|
*.lz filter=lfs diff=lfs merge=lfs -text
|
||||||
|
*.lzma filter=lfs diff=lfs merge=lfs -text
|
||||||
|
*.obscpio filter=lfs diff=lfs merge=lfs -text
|
||||||
|
*.oxt filter=lfs diff=lfs merge=lfs -text
|
||||||
|
*.pdf filter=lfs diff=lfs merge=lfs -text
|
||||||
|
*.png filter=lfs diff=lfs merge=lfs -text
|
||||||
|
*.rpm filter=lfs diff=lfs merge=lfs -text
|
||||||
|
*.tbz filter=lfs diff=lfs merge=lfs -text
|
||||||
|
*.tbz2 filter=lfs diff=lfs merge=lfs -text
|
||||||
|
*.tgz filter=lfs diff=lfs merge=lfs -text
|
||||||
|
*.ttf filter=lfs diff=lfs merge=lfs -text
|
||||||
|
*.txz filter=lfs diff=lfs merge=lfs -text
|
||||||
|
*.whl filter=lfs diff=lfs merge=lfs -text
|
||||||
|
*.xz filter=lfs diff=lfs merge=lfs -text
|
||||||
|
*.zip filter=lfs diff=lfs merge=lfs -text
|
||||||
|
*.zst filter=lfs diff=lfs merge=lfs -text
|
||||||
11
README.SUSE
Normal file
11
README.SUSE
Normal file
@ -0,0 +1,11 @@
|
|||||||
|
The tpm2-abrmd by upstream default allows every local users in the system to
|
||||||
|
access the TPM chip and modify its settings (bsc#1197532). Upstream suggests
|
||||||
|
to use the TPM's internal security features (e.g. password protection) to
|
||||||
|
prevent local users from manipulating the chip without authorization. Still
|
||||||
|
the default behaviour that every user in the system can access TPM features
|
||||||
|
without any authentication could come as a surprise to end users and system
|
||||||
|
integrators alike.
|
||||||
|
|
||||||
|
For this reason on SUSE only members of the 'tss' group are allowed to access
|
||||||
|
the tpm2-abrmd D-Bus interface, thereby mirroring the access permissions of
|
||||||
|
the /dev/tpm0 and /dev/tpmrm0 character devices.
|
||||||
22
harden_tpm2-abrmd.service.patch
Normal file
22
harden_tpm2-abrmd.service.patch
Normal file
@ -0,0 +1,22 @@
|
|||||||
|
Index: tpm2-abrmd-2.4.0/dist/tpm2-abrmd.service.in
|
||||||
|
===================================================================
|
||||||
|
--- tpm2-abrmd-2.4.0.orig/dist/tpm2-abrmd.service.in
|
||||||
|
+++ tpm2-abrmd-2.4.0/dist/tpm2-abrmd.service.in
|
||||||
|
@@ -6,6 +6,17 @@ After=dev-tpm0.device
|
||||||
|
Requires=dev-tpm0.device
|
||||||
|
|
||||||
|
[Service]
|
||||||
|
+# added automatically, for details please see
|
||||||
|
+# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
|
||||||
|
+ProtectSystem=full
|
||||||
|
+ProtectHome=read-only
|
||||||
|
+ProtectHostname=true
|
||||||
|
+ProtectKernelTunables=true
|
||||||
|
+ProtectKernelModules=true
|
||||||
|
+ProtectKernelLogs=true
|
||||||
|
+ProtectControlGroups=true
|
||||||
|
+RestrictRealtime=true
|
||||||
|
+# end of automatic additions
|
||||||
|
Type=dbus
|
||||||
|
BusName=com.intel.tss2.Tabrmd
|
||||||
|
ExecStart=@SBINDIR@/tpm2-abrmd
|
||||||
BIN
tpm2-abrmd-3.0.0.tar.gz
(Stored with Git LFS)
Normal file
BIN
tpm2-abrmd-3.0.0.tar.gz
(Stored with Git LFS)
Normal file
Binary file not shown.
16
tpm2-abrmd-3.0.0.tar.gz.asc
Normal file
16
tpm2-abrmd-3.0.0.tar.gz.asc
Normal file
@ -0,0 +1,16 @@
|
|||||||
|
-----BEGIN PGP SIGNATURE-----
|
||||||
|
|
||||||
|
iQIzBAABCgAdFiEEW0grjj4Z2nyXjh0BbeLpB44fUMEFAmOOF5wACgkQbeLpB44f
|
||||||
|
UMEA7RAAkJDLBahV1hRcBXwM3dbtknHlSC26GgVtw3Q16eXI4e+Hbesjoc0KPrns
|
||||||
|
unWUnGYK+5/KG1FeGMS/4qWIvIKBfBg0KbIWi5AkYNGcjYV7f7rFK/yrYAkfv7AA
|
||||||
|
BcRr0AHH7vl5jNDSejWGwbc0lIl0zC9cjrgkfK20qoR7t4H38m0MkmiHyaiJkYU9
|
||||||
|
GocoEqMO1xAnrWdQ2Ky1fIrKpQHXDxPUWX/YeA5Agqh54EE6Us7kcqTy+umojFkY
|
||||||
|
h2+8GkrxJznMKTC4iChnw2m2/LhpX7KkFuOr5CdAEoMJmRnILx2nvk/Cnrdw1LCV
|
||||||
|
AygFbR+sDQgKE3GmtW3s+VHuTZt06QNJwjO+iriFKi1fFhG4wMdtc6eA09y7+/mo
|
||||||
|
GeWEdTijiLYyIwCUkrPNC+taOzXrTadOteekZEzSrHwgr0Pvbhp/8uxAjH8Oc+NP
|
||||||
|
7R7di1EBPEAACm01wYCKZIH2EqQyToyQ1hP0lZ5GwOLlZkyTDHUMHmtYsRYXRbtV
|
||||||
|
99NqtSuh9hW+s8QZlXTB4VXrp+iMdWw8G/MXAd2Jsbcl9Wnx+LAbuExlp/U2BHtc
|
||||||
|
JnBYh7/7HUvn0wWAN/qXrKwjMm1jppxXEnpjhAKQKG38HkUPTUDYTbcwfx8GOGbY
|
||||||
|
bWr2dTLOlqnncNoz/V7MGP2gxRyLW16wmwZwcK4uAS9daLspfLU=
|
||||||
|
=VUqS
|
||||||
|
-----END PGP SIGNATURE-----
|
||||||
51
tpm2-abrmd.keyring
Normal file
51
tpm2-abrmd.keyring
Normal file
@ -0,0 +1,51 @@
|
|||||||
|
-----BEGIN PGP PUBLIC KEY BLOCK-----
|
||||||
|
|
||||||
|
mQINBFik3GUBEADYDYbSXH3UTr9oCNCI3UxC1hiLH7cM+QIbMtWiwfAbT3G8wrTa
|
||||||
|
NPj00qNvI4wQ/Xm3h0hB7kri7vP0FqIjIwsTdM6ZpFdVHHKW1m4P8fkOcxqmLN0g
|
||||||
|
V36MN5fgoGWf2K94aS7ItoweRMcuHnwWawe6aAtbKSYVqhWhoB/3grgd0xhE61AS
|
||||||
|
o8fJ7uRYNEAYVeOKlC2j+qKfoJbCa6yqZejFwOOzB6qxNRA7JYvckEf8yJ4+Y16m
|
||||||
|
qPyZ1ErHzpql3+b5ha+g+9g8WzxAbSfGYZTwaQxyePNjXuq2tdEXf9XnESvoaoN4
|
||||||
|
pQhiu/0BJEkXPxl1zso65g4Mn22xEELhUnwPDo5YdLlWEZ8xhELLvdJc3Z0nTR5A
|
||||||
|
4/YaZvvzf7pOD1cwpB6IrRf8n9rOe1aDxh/A//zX9PpIOV25p5kqlE88Ya5VXrnA
|
||||||
|
Ayfs19RZmK3+FuaI0ij79CRokG9BrI6TXT0pRTDIRu7GvAo2q13MELRvFddyRT2G
|
||||||
|
mNjsHYcqEbraYTh3LHEiwfWp4ZgDtk8jj3iRabHQUHk9V8vSFzj+wp1E8HzO8Vp3
|
||||||
|
BxMDIOG1VPdLi81DP+LbZI1h30ZG63ulqkKIhwx5/h2v4VCYPatVtGqVf37tLstj
|
||||||
|
Wrs0DkBykuZrecp+AJ5ZJ+UVvR8ajO2ncAoOugNwoj9Wuvz0fVTiJIhuNQARAQAB
|
||||||
|
tDxXaWxsaWFtIFJvYmVydHMgKEJpbGwgUm9iZXJ0cykgPHdpbGxpYW0uYy5yb2Jl
|
||||||
|
cnRzQGludGVsLmNvbT6JAjgEEwECACIFAlik3GUCGwMGCwkIBwMCBhUIAgkKCwQW
|
||||||
|
AgMBAh4BAheAAAoJEG3i6QeOH1DBibEQAL4EwEzegkc8NyHiW0mntwDoCv3tkUlG
|
||||||
|
fprp/g7GWfrP+L+pN5yexg3Zm/CgVN/tTNCEr5XtP+sdds8xBF6ReJ8QPO7EiMiM
|
||||||
|
asPXh8zlODrySXCGHmpa7IzuUC2wgD3Wq7WjniMvnBmqBdL0+8nqA6NFxOOklvK1
|
||||||
|
ub7bqLrHKfUfciFOfYAi+C0Bh8kdZtMjfY9sqlJA3sVK2UxVXq9D+oHbL1o454N6
|
||||||
|
VzV0rDtsK47GSSCXT75kulPdfOCopTgxPgNsK4VnXgMOL5JMURPJa3rBzmBRFed1
|
||||||
|
ynrqwFdmYdMepsUgt/JS2I/23QChqp6AdVDjtGLKS71hox+vdE4S0DoRnMHwHkkt
|
||||||
|
B6bqQci3RlUP+wcHHRCUXUubxMSlYJqhBdEOclo6N0X0LseLcdAMGda8ZnqbHlyg
|
||||||
|
hPLmJrM3C5zTLjDb2YJXCy6RVNwqAnU3o33SZCnHqo/zUjEtR03Ztk1DzSeCjo5w
|
||||||
|
zLac1VFq5S3QdgZUwmPhyeoigqOvHu6Z1s2eL8Aw7Hn8i6MWLz5sOXAtyC9NPwK/
|
||||||
|
qbp1a+GQXzNW4rvKl7ZEFKrBKyj8AiRoVLSRKcqZtFT56ltXQjrwKjsWDTEOzjnm
|
||||||
|
XCSM96xfay6asQH5fw+haC3RIErwyNV0uUDIVC0xDTZ6NgJEBkp8liwNeHE7eHoN
|
||||||
|
8qWSZZO2syf7uQINBFik3GUBEAC7V2o1kBsLFSKwmgsCuGfW0oBIQiaCcakT6D2X
|
||||||
|
rKBjmzBvh/UIdXQwl9+vPKtWX3T/7g6UBvezV3uc2ZqrigGmFemoQI3sW7wFk0L9
|
||||||
|
/QTUWCMfZtyrWgqyetmPYS+i2PnsEPinsgsEHWf3iu/ew1A7npZwINwMdOSOVw2u
|
||||||
|
JqYyW2tZCErWKVe31ziYUpXA+HaRm9zoVr0F0sE2GYGWbMVYtqxN9TSYcIAHxB71
|
||||||
|
Y31dcY77ln/1JAH4Yzqc063w/lNYogEbbQY7WNgcKdPP+aovpV7kS3TKwsdb9/xT
|
||||||
|
pj67nnlvjLTMRoW3Ez0PcIDFhuube9uOQupYG4rC4grLeVLwL/ekVmn6TxRN1hG7
|
||||||
|
6zYXWiwWi16uAO++eBNt127FwCOVZsPO0ye3/XpOpCdpUadguxF2gGt6xY0gtetj
|
||||||
|
Vdv6S4kCdSx8NMrO2epS/1pgklxN9R/xl7Wu+JPUuVX4Jy0ycmw7TCWxdK2fuFy6
|
||||||
|
6aLCXWWEjRSp06oeVJoVV2py+rYaoau7JG7Zgx1A3gYTm6MLFysfROaQgmfRozIH
|
||||||
|
0boYh3IA1WWzk4I6ew129ynC5zGXg/+UCnKKwn8Tsh9neq9noRDAonWI7jOCipwF
|
||||||
|
l51py82093M87zjz9o/qxnB8p00jByQ+MunUykaZrkQKHAsiyIF6cUIeQiy/AL7n
|
||||||
|
wwSPQQARAQABiQIfBBgBAgAJBQJYpNxlAhsMAAoJEG3i6QeOH1DBtO8P/1D98sl3
|
||||||
|
oz/0oSSz0u9nzgOh93UkLbXpjSR4U+g7Wl2ppxQyGSFeWwRwT5BT74EVP2IcrraX
|
||||||
|
V9c7l+s8PYqnUdX2XAqGMv06523cCrNUU93kUUNjAo3FxGSn7i2kHIvMkDbUoeVk
|
||||||
|
jyWKfIvyy2sKcVB9GQxfMrbnTR5/Z6fCyGHNqMFb9e9TUWclLzMIhvtkvLuKmf52
|
||||||
|
TKKxKQt/wero5zb0fynOttIjuhmOP9CFTiYjdj7qSmQapW8VFdYjyzL+OOFk9gCL
|
||||||
|
S3mIk1LdkfWah7trmMUTXdmiEibvARAQ3Yjr+Hz9yU1gzEJSPUUugNguqgS5kN+T
|
||||||
|
3TdwUHAP9whVD2IvN/Mfn29bmFFVfzu3ftJIa1zJmOdZy7KWb6MWVhw3SJ65luPB
|
||||||
|
qxKWRqFDOSpqzBm6bYQ/Oka49Jl7/dCImSm+7bCC7LDK9hXa3AIlDtWvG4iiL18T
|
||||||
|
wUOrgXPysB/D/NQaRxT/vSPUOB4WrQzIKIf4vJdyuPdtOtIWm97KUw8r/jDqd4I3
|
||||||
|
B62qknrrR+FPcz8ACM9fXkpbBEcjFV8EkoOae106Vxjo/lu5LVBbwiKviMMwoK5o
|
||||||
|
YE7FfCwLBbLTYMeetHo8jGBRonTEOKMtPlp/fCMOp9w7CgMDuvfEwuTsA1ux4uAb
|
||||||
|
tZZIbipcKcZmsU7Su4+oeyh61giG++M5rL2D
|
||||||
|
=xdFJ
|
||||||
|
-----END PGP PUBLIC KEY BLOCK-----
|
||||||
340
tpm2.0-abrmd.changes
Normal file
340
tpm2.0-abrmd.changes
Normal file
@ -0,0 +1,340 @@
|
|||||||
|
-------------------------------------------------------------------
|
||||||
|
Tue May 23 12:31:21 UTC 2023 - Alberto Planas Dominguez <aplanas@suse.com>
|
||||||
|
|
||||||
|
- Cover ALP via the %{suse_version} macro
|
||||||
|
|
||||||
|
-------------------------------------------------------------------
|
||||||
|
Thu Dec 8 15:07:28 UTC 2022 - Alberto Planas Dominguez <aplanas@suse.com>
|
||||||
|
|
||||||
|
- Version 3.0.0
|
||||||
|
+ Fixed
|
||||||
|
* A bug in special command processing in TPM2_GetCapability when
|
||||||
|
an audit session is in use cuased tpm2-abrmd to abort.
|
||||||
|
+ Added
|
||||||
|
* New SELinux interfaces for communication with keylime
|
||||||
|
+ Changed
|
||||||
|
* DBUS permissions in tpm2-abrmd.conf to match the in-kernel RM,
|
||||||
|
ie /dev/tpmrm0, permissions. Now users MUST be in the tss group
|
||||||
|
to send to tpm2-abrmd over DBUS.
|
||||||
|
- Drop dbus-access.patch (merged in PR#805)
|
||||||
|
|
||||||
|
-------------------------------------------------------------------
|
||||||
|
Fri Jul 8 08:43:16 UTC 2022 - Alberto Planas Dominguez <aplanas@suse.com>
|
||||||
|
|
||||||
|
- Version 2.4.1
|
||||||
|
+ Added
|
||||||
|
Contributor Covenant Code of Conduct.
|
||||||
|
+ Fixed
|
||||||
|
* superflous warning messages about tcti status.
|
||||||
|
WARNING **: 11:00:56.205: tcti_conf before: "(null)"
|
||||||
|
WARNING **: 11:00:56.205: tcti_conf after: "mssim"
|
||||||
|
* GCC 11 build error: error: argument 2 of __atomic_load’ discards
|
||||||
|
'volatile' qualifier
|
||||||
|
* Initialize gerror pointer variable to NULL to fix use of
|
||||||
|
unitialized memory and segfault.
|
||||||
|
* Updated missing defaults in manpage.
|
||||||
|
* Port CI to composite actions in tpm2-software/ci.
|
||||||
|
+ Removed
|
||||||
|
Dependency on 'which' utility in configure.ac.
|
||||||
|
ubuntu-16.04 from CI.
|
||||||
|
|
||||||
|
-------------------------------------------------------------------
|
||||||
|
Mon Apr 4 10:45:24 UTC 2022 - Matthias Gerstner <matthias.gerstner@suse.com>
|
||||||
|
|
||||||
|
- dbus-access.patch: restrict D-Bus access to tpm2-abrmd to members of the tss
|
||||||
|
group (bsc#1197532). This prevents arbitrary users from meddling with TPM
|
||||||
|
state and thus potential denial-of-service vectors.
|
||||||
|
|
||||||
|
-------------------------------------------------------------------
|
||||||
|
Wed Dec 8 16:50:13 UTC 2021 - Alberto Planas Dominguez <aplanas@suse.com>
|
||||||
|
|
||||||
|
- Version 2.4.0
|
||||||
|
+ remover syslog deprecation warning (bsc#1185154)
|
||||||
|
+ cover update to 2.3.3 (jsc#SLE-17366)
|
||||||
|
+ contains reload fix (bsc#1166936)
|
||||||
|
+ fix tcti loading using short / long names (bsc#1159176)
|
||||||
|
|
||||||
|
-------------------------------------------------------------------
|
||||||
|
Mon Nov 29 12:54:02 UTC 2021 - Alberto Planas Dominguez <aplanas@suse.com>
|
||||||
|
|
||||||
|
- Warp selinux into a bcond
|
||||||
|
|
||||||
|
-------------------------------------------------------------------
|
||||||
|
Thu Nov 25 09:16:32 UTC 2021 - Johannes Segitz <jsegitz@suse.com>
|
||||||
|
|
||||||
|
- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
|
||||||
|
* harden_tpm2-abrmd.service.patch
|
||||||
|
|
||||||
|
-------------------------------------------------------------------
|
||||||
|
Sat Jul 17 21:04:13 UTC 2021 - Callum Farmer <gmbr3@opensuse.org>
|
||||||
|
|
||||||
|
- Move selinux devel file to devel subpackage
|
||||||
|
|
||||||
|
-------------------------------------------------------------------
|
||||||
|
Wed Jul 14 13:41:59 UTC 2021 - Callum Farmer <gmbr3@opensuse.org>
|
||||||
|
|
||||||
|
- Update to version 2.4.0:
|
||||||
|
- Service start depends on systemd device unit: dev-tpm0.device.
|
||||||
|
- Numerous memory leaks.
|
||||||
|
- udev settle service deprecation warnings.
|
||||||
|
- StandardOutput=syslog deprecation warnings.
|
||||||
|
- Add selinux module files
|
||||||
|
- Move dbus files out of /etc
|
||||||
|
|
||||||
|
-------------------------------------------------------------------
|
||||||
|
Wed Jun 9 09:37:38 UTC 2021 - Alberto Planas Dominguez <aplanas@suse.com>
|
||||||
|
|
||||||
|
- Requires libtss2-tcti-{device0,tabrmd0} (bsc#1187077).
|
||||||
|
In MicroOS systems the recommendations are not installed, making the
|
||||||
|
service fail to initialize: Failed to instantiate TCTI
|
||||||
|
|
||||||
|
-------------------------------------------------------------------
|
||||||
|
Thu Oct 22 12:15:24 UTC 2020 - Matthias Gerstner <matthias.gerstner@suse.com>
|
||||||
|
|
||||||
|
- update to version 2.3.3:
|
||||||
|
- changes in version 2.3.1:
|
||||||
|
- Fixed handle resource leak exhausting TPM resources.
|
||||||
|
- changes in version 2.3.2:
|
||||||
|
- Added cirrus CI specific config files to enable FreeBSD builds.
|
||||||
|
- Changed test scripts to be more portable.
|
||||||
|
- Changed include header paths specific to FreeBSD.
|
||||||
|
- changes in version 2.3.1:
|
||||||
|
- Provide meaningful exit codes on initialization failures.
|
||||||
|
- Prevent systemd from starting the daemon before udev changes ownership
|
||||||
|
of the TPM device node.
|
||||||
|
- Prevent systemd from starting the daemon if there is no TPM device node.
|
||||||
|
- Prevent systemd from restarting the daemon if it fails.
|
||||||
|
- Add SELinux policy to allow daemon to resolve names.
|
||||||
|
- Add SELinux policy boolean (disabled by default) to allow daemon to
|
||||||
|
connect to all unreserved ports.
|
||||||
|
|
||||||
|
-------------------------------------------------------------------
|
||||||
|
Wed Dec 11 11:55:13 UTC 2019 - matthias.gerstner@suse.com
|
||||||
|
|
||||||
|
- update to version 2.3.0:
|
||||||
|
- changes in version 2.3.0:
|
||||||
|
- Add '--enable-debug' flag to configure script to simplify debug builds.
|
||||||
|
This relies on the AX_CHECK_ENABLE_DEBUG autoconf archive macro.
|
||||||
|
- Replaced custom dynamic TCTI loading code with libtss2-tctildr from
|
||||||
|
upstream tpm2-tss repo. (requires tpm2-0-tss version 2.3.0)
|
||||||
|
- Explicitly set '-O2' optimization when using FORTIFY_SOURCE as required.
|
||||||
|
- changes in version 2.2.0:
|
||||||
|
- New configuration option `--disable-defaultflags/ added. This is
|
||||||
|
for use for packaging for targets that do not support the default
|
||||||
|
compilation / linking flags.
|
||||||
|
- Use private dependencies properly in pkg-config metadata for TCTI.
|
||||||
|
- Refactor daemon main module to enable better handling of error
|
||||||
|
conditions and enable more thorough unit testing.
|
||||||
|
- Updated dependencies to ensure compatibility with pkg-config fixes
|
||||||
|
in tpm2-tss.
|
||||||
|
- Fixed bug causing TCTI to block when used by libtss2-sys built with
|
||||||
|
partial reads enabled.
|
||||||
|
- Removed unnecessary libs / flags for pthreads in the TCTI pkg-config.
|
||||||
|
- Output from configure script now accurately describes the state of the
|
||||||
|
flags that govern the integration tests.
|
||||||
|
- drop fix_dlopen.patch: no longer necessary since abrmd not uses the tctildr
|
||||||
|
shared library. This one hopefully now does the right thing.
|
||||||
|
|
||||||
|
-------------------------------------------------------------------
|
||||||
|
Mon Aug 26 06:49:37 UTC 2019 - mgerstner <matthias.gerstner@suse.com>
|
||||||
|
|
||||||
|
- update to version 2.1.1:
|
||||||
|
- changes in version 2.1.1:
|
||||||
|
- Unit tests accessing dbus have been fixed to use mock functions. Unit
|
||||||
|
tests no longer depend on dbus.
|
||||||
|
- Race condition between client connections and dbus proxy object
|
||||||
|
creation by registering bus name after instantiation of the proxy object.
|
||||||
|
|
||||||
|
-------------------------------------------------------------------
|
||||||
|
Fri Apr 26 10:35:51 UTC 2019 - mvetter@suse.com
|
||||||
|
|
||||||
|
- bsc#1130588: Require shadow instead of old pwdutils
|
||||||
|
|
||||||
|
-------------------------------------------------------------------
|
||||||
|
Wed Mar 6 10:36:46 UTC 2019 - matthias.gerstner@suse.com
|
||||||
|
|
||||||
|
- update to version 2.1.0:
|
||||||
|
- changes in version 2.1.0:
|
||||||
|
- `-Wstrict-overflow=5` now used in default CFLAGS.
|
||||||
|
- Handling of `TPM2_RC_CONTEXT_GAP` on behalf of users.
|
||||||
|
- Convert `TPM2_PT_CONTEXT_GAP_MAX` response from lower layer to
|
||||||
|
`UINT32_MAX`
|
||||||
|
- travis-ci now uses 'xenial' builder
|
||||||
|
- Significant refactoring of TCTI handling code.
|
||||||
|
- `--install` added to ACLOCAL_AMFLAGS to install aclocal required macros
|
||||||
|
instead of using the default symlinks
|
||||||
|
- Launch `dbus-run-session` in the automake test environment to
|
||||||
|
automagically set up a dbus session bus instance when one isn't present.
|
||||||
|
- Bug caused by unloading of `libtss2-tcti-tabrmd.so` on dlclose. GLib
|
||||||
|
does not support reloading a second time.
|
||||||
|
- Bug causing `-fstack-protector-all` to be used on systems with core
|
||||||
|
libraries (i.e. libc) that do not support it. This caused failures at
|
||||||
|
link-time.
|
||||||
|
- Unnecessary symbols from libtest utility library no longer included in
|
||||||
|
TCTI library.
|
||||||
|
- changes in version 2.0.3:
|
||||||
|
- Update build to account for upstream change to glib '.pc' files
|
||||||
|
described in: https://gitlab.gnome.org/GNOME/glib/issues/1521
|
||||||
|
- added _service file for syncing with upstream tags
|
||||||
|
|
||||||
|
-------------------------------------------------------------------
|
||||||
|
Thu Oct 25 09:00:40 UTC 2018 - matthias.gerstner@suse.com
|
||||||
|
|
||||||
|
- add a Requires towards tpm2-0-tss, because that main package holds the udev
|
||||||
|
rules and logic for setting up the tss user. Without this the daemon can't
|
||||||
|
start up correctly.
|
||||||
|
|
||||||
|
-------------------------------------------------------------------
|
||||||
|
Tue Oct 23 15:46:28 UTC 2018 - matthias.gerstner@suse.com
|
||||||
|
|
||||||
|
- fix broken build due to newer glib dependency that reports a full path for
|
||||||
|
gdbus-codegen, breaking the configure check.
|
||||||
|
|
||||||
|
-------------------------------------------------------------------
|
||||||
|
Wed Sep 26 15:51:01 UTC 2018 - matthias.gerstner@suse.com
|
||||||
|
|
||||||
|
- update to version 2.0.2 (FATE#326270):
|
||||||
|
- --enable-integration option to configure script now works as documented.
|
||||||
|
- Format specifier with wrong size in util module.
|
||||||
|
- Initialize TCTI context to 0 before setting values. This will cause all
|
||||||
|
members that aren't explicitly initialized by be 0.
|
||||||
|
|
||||||
|
-------------------------------------------------------------------
|
||||||
|
Tue Sep 18 09:05:24 UTC 2018 - matthias.gerstner@suse.com
|
||||||
|
|
||||||
|
- add recommends to the tcti-device and tcti-abrmd. Otherwise they're not
|
||||||
|
installed right away, rendering the abrmd quite unusable.
|
||||||
|
|
||||||
|
-------------------------------------------------------------------
|
||||||
|
Fri Aug 10 10:02:21 UTC 2018 - matthias.gerstner@suse.com
|
||||||
|
|
||||||
|
- Update to version 2.0.1:
|
||||||
|
* SessionList: Fix Connection object reference leak.
|
||||||
|
* source/sink: Organize ControlMessage processing.
|
||||||
|
* CommandSource: Replace 'connection-removed' signal with ControlMessage.
|
||||||
|
* SessionList: Remove all locking.
|
||||||
|
* ConnectionManager: Remove 'connection-removed' signal.
|
||||||
|
* ci: Build 'check' target when CC is gcc.
|
||||||
|
* build: Fix bad URLs in configure script.
|
||||||
|
* CHANGELOG.md: Add version number and date for 2.0.1 release.
|
||||||
|
* Replace references to drand48_r family of functions for portability
|
||||||
|
* Fix for type-punned pointer reported in newer compilers that enforce strict aliasing
|
||||||
|
|
||||||
|
-------------------------------------------------------------------
|
||||||
|
Tue Jul 3 09:15:27 UTC 2018 - matthias.gerstner@suse.com
|
||||||
|
|
||||||
|
- Trying to fix build on older distros that fail because of a missing or
|
||||||
|
broken autoconf valgrind detection macro. Removing autoreconf to hopefully
|
||||||
|
fix this.
|
||||||
|
|
||||||
|
-------------------------------------------------------------------
|
||||||
|
Mon Jul 2 09:27:43 UTC 2018 - matthias.gerstner@suse.com
|
||||||
|
|
||||||
|
- add fix_dlopen.patch: fixes an issue with dlopen()'ing the tcti-device
|
||||||
|
library from tpm2-0-tss. See
|
||||||
|
https://github.com/tpm2-software/tpm2-abrmd/issues/486.
|
||||||
|
|
||||||
|
-------------------------------------------------------------------
|
||||||
|
Fri Jun 29 11:43:08 UTC 2018 - matthias.gerstner@suse.com
|
||||||
|
|
||||||
|
- update to major version 2.0.0:
|
||||||
|
- support_dbus_activation.diff: removed, is not contained upstream
|
||||||
|
- the tpm2 stack introduces an incompatible ABI to the previous version with
|
||||||
|
this update. There is no compatibility layer, libraries have new names
|
||||||
|
etc.
|
||||||
|
- upstream changelog:
|
||||||
|
## 2.0.0 - 2018-06-22
|
||||||
|
### Added
|
||||||
|
- Integration test script and build support to execute integration tests
|
||||||
|
against a physical TPM2 device on the build platform.
|
||||||
|
- Implementation of dynamic TCTI initialization mechanism.
|
||||||
|
- configure option `--enable-integration` to enable integration tests.
|
||||||
|
The simulator executable must be on PATH.
|
||||||
|
- Support for version 2.0 of tpm2-tss libraries.
|
||||||
|
### Changed
|
||||||
|
- 'max-transient-objects' command line option renamted to 'max-transients'.
|
||||||
|
- Added -Wextra for more strict checks at compile time.
|
||||||
|
- Install location of headers to $(includedir)/tss2.
|
||||||
|
### Fixed
|
||||||
|
- Added missing checks for NULL parameters identified by the check-build.
|
||||||
|
- Bug in session continuation logic.
|
||||||
|
- Off by one error in HandleMap.
|
||||||
|
- Memory leak and uninitialized variable issues in unit tests.
|
||||||
|
### Removed
|
||||||
|
- Command line option --fail-on-loaded-trans.
|
||||||
|
- udev rules for TPM device node. This now lives in the tpm2-tss repo.
|
||||||
|
- Remove legacy TCTI initialization functions.
|
||||||
|
- configure option `--with-simulatorbin`.
|
||||||
|
|
||||||
|
## 1.3.1 - 2018-03-18
|
||||||
|
### Fixed
|
||||||
|
- Distribute systemd preset template instead of the generated file.
|
||||||
|
|
||||||
|
## 1.3.0 - 2018-03-02
|
||||||
|
### Added
|
||||||
|
- New configure option (--test-hwtpm) to run integration tests against a
|
||||||
|
physical TPM2 device on the build platform.
|
||||||
|
- Install systemd service file to allow on-demand systemd unit activation.
|
||||||
|
### Changed
|
||||||
|
- Converted some inappropriate uses of g_error to critical / warning instead.
|
||||||
|
- Removed use of gen_require from SELinux policy, use dbus_stub instead.
|
||||||
|
- udev rules now give tss group read / write access to the TPM device node.
|
||||||
|
- udev rules now give tss user and group read / write access to kernel RM
|
||||||
|
node.
|
||||||
|
### Fixed
|
||||||
|
- Memory leak on an error path in the AccessBroker.
|
||||||
|
|
||||||
|
-------------------------------------------------------------------
|
||||||
|
Thu Feb 22 11:34:51 UTC 2018 - matthias.gerstner@suse.com
|
||||||
|
|
||||||
|
- update to upstream version 1.2.0:
|
||||||
|
- Limit maximum number of active sessions per connection with '--max-sessions'.
|
||||||
|
- Flush all transient objects and sessions on daemon start with '--flush-all'.
|
||||||
|
- Allow passing of sessions across connections with ContextSave / Load.
|
||||||
|
- Unref the GUnixFDList returned by GIO / dbus in the TCTI init function.
|
||||||
|
This fixes a memory leak in the TCTI library.
|
||||||
|
- correctly trigger udev to update /dev/tpm* permissions after package
|
||||||
|
installation. (bnc#1078687)
|
||||||
|
- prepared support_dbus_activation.diff patch which adds D-Bus activation, but
|
||||||
|
can't use it yet due to rpmlint
|
||||||
|
|
||||||
|
-------------------------------------------------------------------
|
||||||
|
Wed Nov 15 11:43:19 UTC 2017 - matthias.gerstner@suse.com
|
||||||
|
|
||||||
|
- fix_service_paths.diff: fixed broken systemd service unit (bnc#1066123). the
|
||||||
|
service unit file in the upstream distribution tarball is already configured
|
||||||
|
and looks for binaries and configuration files in the /usr/local prefix
|
||||||
|
which is wrong.
|
||||||
|
|
||||||
|
-------------------------------------------------------------------
|
||||||
|
Fri Sep 1 14:37:48 UTC 2017 - matthias.gerstner@suse.com
|
||||||
|
|
||||||
|
- package version symlink correctly, belongs into the lib package itself, not
|
||||||
|
the -devel.
|
||||||
|
|
||||||
|
-------------------------------------------------------------------
|
||||||
|
Wed Aug 30 08:29:07 UTC 2017 - matthias.gerstner@suse.com
|
||||||
|
|
||||||
|
- update to upstream version 1.1.1 which fixes some local denial-of-service
|
||||||
|
security issues among other things:
|
||||||
|
|
||||||
|
- Replace use of sigaction with g_unix_signal_* stuff from glib.
|
||||||
|
- Rewrite of INSTALL.md including info on custom configure script options.
|
||||||
|
- Default value for --with-simulatorbin configure option has been removed.
|
||||||
|
New default behavior is to disable integration tests.
|
||||||
|
- CommandSource will no longer reject commands without parameters.
|
||||||
|
- Unit tests updated to use cmocka v1.0.0 API.
|
||||||
|
- Integration tests now run daemon under valgrind memcheck and fail when
|
||||||
|
errors are found.
|
||||||
|
- CommandSource now tracks max FD in set of client FDs to prevent unnecessary
|
||||||
|
iterations over FD_SETSIZE fds.
|
||||||
|
|
||||||
|
- no longer call bootstrap and switch to the release upstream tarball which
|
||||||
|
has now been fixed to contain all necessary files
|
||||||
|
|
||||||
|
-------------------------------------------------------------------
|
||||||
|
Thu Jul 20 13:04:41 UTC 2017 - matthias.gerstner@suse.com
|
||||||
|
|
||||||
|
- first version of the new arbmd resource manager from Intel's tpm2 stack.
|
||||||
|
This will replace the old resourcemgr previously shipped with the
|
||||||
|
tpm2-0-tss package.
|
||||||
1
tpm2.0-abrmd.rpmlintrc
Normal file
1
tpm2.0-abrmd.rpmlintrc
Normal file
@ -0,0 +1 @@
|
|||||||
|
addFilter("shared-lib-calls-exit */usr/lib64/libtss2-tcti-tabrmd.so*")
|
||||||
198
tpm2.0-abrmd.spec
Normal file
198
tpm2.0-abrmd.spec
Normal file
@ -0,0 +1,198 @@
|
|||||||
|
#
|
||||||
|
# spec file for package tpm2.0-abrmd
|
||||||
|
#
|
||||||
|
# Copyright (c) 2023 SUSE LLC
|
||||||
|
#
|
||||||
|
# All modifications and additions to the file contributed by third parties
|
||||||
|
# remain the property of their copyright owners, unless otherwise agreed
|
||||||
|
# upon. The license for this file, and modifications and additions to the
|
||||||
|
# file, is the same license as for the pristine package itself (unless the
|
||||||
|
# license for the pristine package is not an Open Source License, in which
|
||||||
|
# case the license is the MIT License). An "Open Source License" is a
|
||||||
|
# license that conforms to the Open Source Definition (Version 1.9)
|
||||||
|
# published by the Open Source Initiative.
|
||||||
|
|
||||||
|
# Please submit bugfixes or comments via https://bugs.opensuse.org/
|
||||||
|
#
|
||||||
|
|
||||||
|
|
||||||
|
%global selinuxtype targeted
|
||||||
|
%global modulename tabrmd
|
||||||
|
# the auto activation is not whitelisted for <= SLE12-SP3 (includes
|
||||||
|
# ALP in the with %{suse_version}
|
||||||
|
%if 0%{?sle_version} > 120300 || 0%{?is_opensuse} || 0%{?suse_version} >= 1600
|
||||||
|
%define install_dbus_files 1
|
||||||
|
%endif
|
||||||
|
# selinux only for Tumbleweed for now
|
||||||
|
%if 0%{?suse_version} >= 1550 && 0%{?is_opensuse}
|
||||||
|
%bcond_without selinux
|
||||||
|
%else
|
||||||
|
%bcond_with selinux
|
||||||
|
%endif
|
||||||
|
Name: tpm2.0-abrmd
|
||||||
|
Version: 3.0.0
|
||||||
|
Release: 0
|
||||||
|
Summary: Intel's TCG Software Stack Access Broker & Resource Manager for TPM 2.0 chips
|
||||||
|
License: BSD-2-Clause
|
||||||
|
Group: Productivity/Security
|
||||||
|
URL: https://github.com/tpm2-software/tpm2-abrmd
|
||||||
|
Source0: https://github.com/tpm2-software/tpm2-abrmd/releases/download/%{version}/tpm2-abrmd-%{version}.tar.gz
|
||||||
|
Source1: https://github.com/tpm2-software/tpm2-abrmd/releases/download/%{version}/tpm2-abrmd-%{version}.tar.gz.asc
|
||||||
|
# curl https://github.com/williamcroberts.gpg > tpm2-abrmd.keyring
|
||||||
|
Source2: tpm2-abrmd.keyring
|
||||||
|
Source3: tpm2.0-abrmd.rpmlintrc
|
||||||
|
Source4: README.SUSE
|
||||||
|
Patch0: harden_tpm2-abrmd.service.patch
|
||||||
|
BuildRequires: autoconf-archive
|
||||||
|
BuildRequires: automake
|
||||||
|
BuildRequires: checkpolicy
|
||||||
|
BuildRequires: gcc-c++
|
||||||
|
BuildRequires: libtool
|
||||||
|
BuildRequires: pkgconfig
|
||||||
|
BuildRequires: policycoreutils
|
||||||
|
BuildRequires: systemd-rpm-macros
|
||||||
|
BuildRequires: pkgconfig(dbus-1)
|
||||||
|
BuildRequires: pkgconfig(gio-unix-2.0)
|
||||||
|
BuildRequires: pkgconfig(tss2-sys)
|
||||||
|
Requires: libtss2-tcti-device0
|
||||||
|
Requires: libtss2-tcti-tabrmd0
|
||||||
|
Requires: tpm2-0-tss
|
||||||
|
Requires(pre): user(tss)
|
||||||
|
%if %{with selinux}
|
||||||
|
BuildRequires: selinux-policy-devel
|
||||||
|
BuildRequires: selinux-policy-targeted
|
||||||
|
BuildRequires: pkgconfig(systemd)
|
||||||
|
Requires: (%{name}-selinux if selinux-policy-base)
|
||||||
|
%endif
|
||||||
|
|
||||||
|
%description
|
||||||
|
The tpm2.0-abrmd package provides the TPM2 Access Broker & Resource Manager.
|
||||||
|
This is a daemon service that coordinates requests to the TPM2 chip via
|
||||||
|
Intel's TPM 2.0 software stack.
|
||||||
|
|
||||||
|
%package devel
|
||||||
|
Summary: Development headers the Access Broker & Resource Manager for TPM 2.0 chips
|
||||||
|
Group: Development/Libraries/C and C++
|
||||||
|
Requires: glibc-devel
|
||||||
|
Requires: libtss2-tcti-tabrmd0 = %{version}
|
||||||
|
Requires: tpm2.0-abrmd = %{version}
|
||||||
|
|
||||||
|
%description devel
|
||||||
|
This package provides the development files for the Access Broker & Resource
|
||||||
|
Manager for coordinating access to TPM 2.0 chips.
|
||||||
|
|
||||||
|
%if %{with selinux}
|
||||||
|
%package selinux
|
||||||
|
Summary: SELinux module for the Access Broker & Resource Manager for TPM 2.0 chips
|
||||||
|
Group: System/Management
|
||||||
|
Requires: tpm2.0-abrmd = %{version}
|
||||||
|
BuildArch: noarch
|
||||||
|
%{selinux_requires}
|
||||||
|
|
||||||
|
%description selinux
|
||||||
|
This package provides the SELinux module for the Access Broker & Resource Manager for TPM 2.0 chips.
|
||||||
|
%endif
|
||||||
|
|
||||||
|
%package -n libtss2-tcti-tabrmd0
|
||||||
|
Summary: Client interface library for tpm2-abrmd
|
||||||
|
Group: System/Libraries
|
||||||
|
|
||||||
|
%description -n libtss2-tcti-tabrmd0
|
||||||
|
This library allows to interact with the tpm2-abrmd daemon. It is intended for
|
||||||
|
use with the SAPI library (libtss2-sys) like any other TCTI.
|
||||||
|
|
||||||
|
%post -n libtss2-tcti-tabrmd0 -p /sbin/ldconfig
|
||||||
|
%postun -n libtss2-tcti-tabrmd0 -p /sbin/ldconfig
|
||||||
|
|
||||||
|
%prep
|
||||||
|
%autosetup -n tpm2-abrmd-%{version} -p1
|
||||||
|
|
||||||
|
%build
|
||||||
|
export CFLAGS="%{optflags} -fPIE"
|
||||||
|
export LDFLAGS="$LDFLAGS -pie"
|
||||||
|
%configure \
|
||||||
|
--disable-static \
|
||||||
|
%{?with_selinux: --with-sepolicy=yes} \
|
||||||
|
--with-systemdsystemunitdir=%{_unitdir} \
|
||||||
|
--with-dbuspolicydir=%{_datadir}/dbus-1/system.d
|
||||||
|
%make_build PTHREAD_LDFLAGS=-pthread
|
||||||
|
|
||||||
|
%install
|
||||||
|
%make_install
|
||||||
|
# don't package libtool files as is best practice
|
||||||
|
find %{buildroot} -type f -name "*.la" -delete -print
|
||||||
|
ln -sv %{_sbindir}/service %{buildroot}%{_sbindir}/rctpm2-abrmd
|
||||||
|
# don't install the systemd preset, our presets are handled by
|
||||||
|
# systemd-presets-* packages
|
||||||
|
rm %{buildroot}%{_prefix}/lib*/systemd/system-preset/tpm2-abrmd.preset
|
||||||
|
cp %{SOURCE4} .
|
||||||
|
%if ! 0%{?install_dbus_files}
|
||||||
|
rm %{buildroot}/%{_sysconfdir}/dbus-1/system.d/tpm2-abrmd.conf
|
||||||
|
rm %{buildroot}/%{_datadir}/dbus-1/system-services/com.intel.tss2.Tabrmd.service
|
||||||
|
%endif
|
||||||
|
%if %{with selinux}
|
||||||
|
mkdir %{buildroot}%{_datadir}/selinux/packages/targeted
|
||||||
|
mv %{buildroot}%{_datadir}/selinux/packages/tab* %{buildroot}%{_datadir}/selinux/packages/targeted
|
||||||
|
%endif
|
||||||
|
|
||||||
|
%pre
|
||||||
|
%service_add_pre tpm2-abrmd.service
|
||||||
|
|
||||||
|
%post
|
||||||
|
%service_add_post tpm2-abrmd.service
|
||||||
|
|
||||||
|
%postun
|
||||||
|
%service_del_postun tpm2-abrmd.service
|
||||||
|
|
||||||
|
%preun
|
||||||
|
%service_del_preun tpm2-abrmd.service
|
||||||
|
|
||||||
|
%if %{with selinux}
|
||||||
|
%pre selinux
|
||||||
|
%{selinux_relabel_pre -s %{selinuxtype}}
|
||||||
|
|
||||||
|
%post selinux
|
||||||
|
%{selinux_modules_install -s %{selinuxtype} -p 200 %{_datadir}/selinux/packages/targeted/%{modulename}.pp.bz2}
|
||||||
|
|
||||||
|
%postun selinux
|
||||||
|
if [ $1 -eq 0 ]; then
|
||||||
|
%{selinux_modules_uninstall -s %{selinuxtype} -p 200 %{modulename}}
|
||||||
|
fi
|
||||||
|
|
||||||
|
%posttrans selinux
|
||||||
|
%{selinux_relabel_post -s %{selinuxtype}}
|
||||||
|
%endif
|
||||||
|
|
||||||
|
%files
|
||||||
|
%doc *.md README.SUSE
|
||||||
|
%license LICENSE
|
||||||
|
%{_mandir}/man7/tss2-*
|
||||||
|
%{_mandir}/man8/tpm2-*
|
||||||
|
%{_sbindir}/tpm2-abrmd
|
||||||
|
%{_sbindir}/rctpm2-abrmd
|
||||||
|
%{_unitdir}/tpm2-abrmd.service
|
||||||
|
%if 0%{?install_dbus_files}
|
||||||
|
# the auto activation is not whitelisted for <= SLE12-SP3
|
||||||
|
%{_datadir}/dbus-1/system.d/tpm2-abrmd.conf
|
||||||
|
%{_datadir}/dbus-1/system-services/com.intel.tss2.Tabrmd.service
|
||||||
|
%endif
|
||||||
|
|
||||||
|
%if %{with selinux}
|
||||||
|
%files selinux
|
||||||
|
%{_datadir}/selinux/packages/targeted/tabrmd.pp.bz2
|
||||||
|
%ghost %verify(not md5 size mtime) %{_sharedstatedir}/selinux/%{selinuxtype}/active/modules/200/%{modulename}
|
||||||
|
%endif
|
||||||
|
|
||||||
|
%files devel
|
||||||
|
%{_includedir}/tss2
|
||||||
|
%{_libdir}/*.so
|
||||||
|
%{_libdir}/pkgconfig/*.pc
|
||||||
|
%{_mandir}/man3/Tss2*
|
||||||
|
%if %{with selinux}
|
||||||
|
%{_datadir}/selinux/devel/include/contrib/tabrmd.if
|
||||||
|
%endif
|
||||||
|
|
||||||
|
%files -n libtss2-tcti-tabrmd0
|
||||||
|
%{_libdir}/libtss2-tcti-tabrmd.so.*
|
||||||
|
|
||||||
|
%changelog
|
||||||
Loading…
Reference in New Issue
Block a user