- create tss user account and install udev rule to fix startup of resourcemgr
(bnc#1038586) OBS-URL: https://build.opensuse.org/package/show/security/tpm2-0-tss?expand=0&rev=41
This commit is contained in:
parent
f8154f343e
commit
9661aea8f5
@ -1,3 +1,9 @@
|
|||||||
|
-------------------------------------------------------------------
|
||||||
|
Thu May 11 15:13:49 UTC 2017 - matthias.gerstner@suse.com
|
||||||
|
|
||||||
|
- create tss user account and install udev rule to fix startup of resourcemgr
|
||||||
|
(bnc#1038586)
|
||||||
|
|
||||||
-------------------------------------------------------------------
|
-------------------------------------------------------------------
|
||||||
Wed May 10 13:33:16 CEST 2017 - mgerstner@suse.com
|
Wed May 10 13:33:16 CEST 2017 - mgerstner@suse.com
|
||||||
|
|
||||||
|
@ -36,7 +36,10 @@ Requires(pre): pwdutils
|
|||||||
BuildRoot: %{_tmppath}/%{name}-%{version}-build
|
BuildRoot: %{_tmppath}/%{name}-%{version}-build
|
||||||
|
|
||||||
%description
|
%description
|
||||||
The tpm2-0-tss package provides a TPM 2.0 TSS implementation.
|
The tpm2-0-tss package provides a TPM 2.0 TSS implementation. This
|
||||||
|
implementation is developed by INTEL. Note that the current resource manager
|
||||||
|
imiplementation is considered deprecated (a prototype, probably buggy and
|
||||||
|
insecure) by its developers.
|
||||||
|
|
||||||
%package devel
|
%package devel
|
||||||
Summary: Development headers for the Intel TSS library for TPM 2.0 chips
|
Summary: Development headers for the Intel TSS library for TPM 2.0 chips
|
||||||
@ -92,6 +95,7 @@ find %{buildroot} -type f -name "*.la" -delete -print
|
|||||||
install -D -m 0644 contrib/resourcemgr.service %{buildroot}/%{_unitdir}/resourcemgr.service
|
install -D -m 0644 contrib/resourcemgr.service %{buildroot}/%{_unitdir}/resourcemgr.service
|
||||||
sed -e 's#usr/local/sbin/#usr/sbin/#;' -i %{buildroot}/%{_unitdir}/resourcemgr.service
|
sed -e 's#usr/local/sbin/#usr/sbin/#;' -i %{buildroot}/%{_unitdir}/resourcemgr.service
|
||||||
ln -sv %{_sbindir}/service %{buildroot}%{_sbindir}/rcresourcemgr
|
ln -sv %{_sbindir}/service %{buildroot}%{_sbindir}/rcresourcemgr
|
||||||
|
install -D -m 0644 contrib/tpm-udev.rules %{buildroot}%{_udevrulesdir}/tpm-udev.rules
|
||||||
|
|
||||||
%post -n libsapi0 -p /sbin/ldconfig
|
%post -n libsapi0 -p /sbin/ldconfig
|
||||||
%postun -n libsapi0 -p /sbin/ldconfig
|
%postun -n libsapi0 -p /sbin/ldconfig
|
||||||
@ -101,6 +105,26 @@ ln -sv %{_sbindir}/service %{buildroot}%{_sbindir}/rcresourcemgr
|
|||||||
%postun -n libtcti-socket0 -p /sbin/ldconfig
|
%postun -n libtcti-socket0 -p /sbin/ldconfig
|
||||||
|
|
||||||
%pre
|
%pre
|
||||||
|
# the same user is employed by trousers:
|
||||||
|
#
|
||||||
|
# trousers just needs those accounts for dropping privileges to. The service
|
||||||
|
# starts as root and uses set*id to drop to tss, after the tpm device has been
|
||||||
|
# opened.
|
||||||
|
#
|
||||||
|
# resourcemgr has no set*id handling and thus requires /dev/tpm to be owned
|
||||||
|
# by the tss user. Therefore we also need to install a udev rule file.
|
||||||
|
#
|
||||||
|
# trousers was here first and created the user like this, also giving it a
|
||||||
|
# home in /var/lib/tpm. I don't think the home directory is used by any of
|
||||||
|
# both packages ATM. Trousers is keeping state there, but the directory is
|
||||||
|
# owned by root and files are opened before dropping privileges. The passwd
|
||||||
|
# entry seems not to be evaluated.
|
||||||
|
#
|
||||||
|
# so I guess we can share the account between the two packages for now.
|
||||||
|
%_bindir/getent group tss >/dev/null || %{_sbindir}/groupadd -g 98 tss || :
|
||||||
|
%_bindir/getent passwd tss >/dev/null || \
|
||||||
|
%{_sbindir}/useradd -u 98 -o -g tss -s /bin/false -c "TSS daemon" \
|
||||||
|
-d %{_localstatedir}/lib/tpm tss || :
|
||||||
%service_add_pre resourcemgr.service
|
%service_add_pre resourcemgr.service
|
||||||
|
|
||||||
%post
|
%post
|
||||||
@ -118,6 +142,7 @@ ln -sv %{_sbindir}/service %{buildroot}%{_sbindir}/rcresourcemgr
|
|||||||
%{_sbindir}/resourcemgr
|
%{_sbindir}/resourcemgr
|
||||||
/%{_unitdir}/resourcemgr.service
|
/%{_unitdir}/resourcemgr.service
|
||||||
%{_sbindir}/rcresourcemgr
|
%{_sbindir}/rcresourcemgr
|
||||||
|
%{_udevrulesdir}/tpm-udev.rules
|
||||||
|
|
||||||
%files devel
|
%files devel
|
||||||
%defattr(-,root,root)
|
%defattr(-,root,root)
|
||||||
@ -126,7 +151,7 @@ ln -sv %{_sbindir}/service %{buildroot}%{_sbindir}/rcresourcemgr
|
|||||||
%{_libdir}/*.so
|
%{_libdir}/*.so
|
||||||
%{_libdir}/pkgconfig/*.pc
|
%{_libdir}/pkgconfig/*.pc
|
||||||
##only available in static form
|
##only available in static form
|
||||||
#%{_libdir}/libtddl.a
|
#%%{_libdir}/libtddl.a
|
||||||
|
|
||||||
%files -n libsapi0
|
%files -n libsapi0
|
||||||
%defattr(-,root,root)
|
%defattr(-,root,root)
|
||||||
|
Loading…
Reference in New Issue
Block a user