From 72d45a672a5ea45439f9d4f630063e70872ed8cb Mon Sep 17 00:00:00 2001
From: Kiran Kamineni <kiran.k.kamineni@intel.com>
Date: Tue, 28 Aug 2018 16:24:42 -0700
Subject: Modify initialization to remove ownership step

TPM ownership and primary key creation is assumed to be a step that is
executed by the system administrator who will provide the credentials
to pods during startup [Srini]. Now, init only reads the public portion of the
primary key and puts it the host folder.
P9: Remove init.sh. Not needed as initialize will directly talk to device now.
Initialize is called during Step 1 and run_abrmd is called during Step 2

Issue-ID: AAF-409
Change-Id: Id0d1860f257c98045613e90b6b88e37858a9aceb
Signed-off-by: Kiran Kamineni <kiran.k.kamineni@intel.com>
---
 bin/abrmdcontainer/create_primary.sh | 62 ++++++++++++++++++++++++
 bin/abrmdcontainer/init.sh           | 43 -----------------
 bin/abrmdcontainer/initialize_tpm.sh | 93 +++++++++++-------------------------
 bin/abrmdcontainer/run_abrmd.sh      |  2 +
 4 files changed, 91 insertions(+), 109 deletions(-)
 create mode 100755 bin/abrmdcontainer/create_primary.sh
 delete mode 100755 bin/abrmdcontainer/init.sh

(limited to 'bin/abrmdcontainer')

diff --git a/bin/abrmdcontainer/create_primary.sh b/bin/abrmdcontainer/create_primary.sh
new file mode 100755
index 0000000..3d4f0f9
--- /dev/null
+++ b/bin/abrmdcontainer/create_primary.sh
@@ -0,0 +1,62 @@
+#!/bin/sh
+
+# Utility Script to create a primary key
+# Uses TCTI as device
+# It takes three arguments, a STORAGE HANDLE, the RH_OWNER Password and the KEY PASSWORD
+SRKHANDLE=$1
+O_PASSWORD=$2
+KEY_PASSWORD=$3
+
+# TPM Startup
+echo "tpm2_startup --clear -T device --verbose"
+tpm2_startup --clear -T device --verbose
+if [ $? -ne 0 ]; then echo; echo -e "${RED}Error, Exit.";
+error=$(echo "TPM Startup failed"); flag="0";
+echo "flag:${flag}" >> ${WORKDIR}/tpm_status.yaml;
+echo "error:${error}" >> ${WORKDIR}/tpm_status.yaml;
+exit 1;
+fi
+echo ""
+
+#Check if Primary Key already exists
+echo "tpm2_readpublic -H ${SRKHANDLE} --opu out_primary_public -T device --verbose"
+tpm2_readpublic -H ${SRKHANDLE} --opu out_primary_public -T device -V
+
+if [ $? -ne 0 ]; then echo; echo -e "${YELLOW} Primary Key does not exist, creating...";
+    rm -f PrimaryKeyBlob
+    echo "tpm2_createprimary -P ${O_PASSWORD} -K ${KEY_PASSWORD} -A o -g 0x000B
+        -G 0x0001 -T device -V -C PrimaryKeyBlob"
+
+    tpm2_createprimary -P ${O_PASSWORD} -K ${KEY_PASSWORD} -A o -g 0x000B \
+        -G 0x0001 -T device -V -C PrimaryKeyBlob
+
+    if [ $? -ne 0 ]; then echo; echo -e "${RED}Error, Exit.";
+        error=$(echo "Error: TPM create Primary key failed");
+        echo "$error"; flag="0";
+        echo "flag:${flag}" >> ${WORKDIR}/tpm_status.yaml;
+        echo "error:${error}" >> ${WORKDIR}/tpm_status.yaml;
+        exit 1;
+    fi
+    echo ""
+
+
+    #Store Primary Key in TPMs NV RAM
+    echo "tpm2_evictcontrol -A o -c ./PrimaryKeyBlob -S ${SRKHANDLE}
+        -T device -V -P ${O_PASSWORD}"
+
+    tpm2_evictcontrol -A o -c ./PrimaryKeyBlob -S ${SRKHANDLE} \
+        -T device -V -P ${O_PASSWORD}
+
+    if [ $? -ne 0 ]; then echo; echo -e "${RED}Error, Exit.";
+    error=$(echo "Error: Inserting Primary Key failed");
+    echo "$error"; flag="0";
+    echo "flag:${flag}" >> ${WORKDIR}/tpm_status.yaml;
+    echo "errror:${error}" >> ${WORKDIR}/tpm_status.yaml;
+    rm -f PrimaryKeyBlob
+    exit 1;
+    fi
+    echo ""
+    rm -f PrimaryKeyBlob
+fi
+
+#END
\ No newline at end of file
diff --git a/bin/abrmdcontainer/init.sh b/bin/abrmdcontainer/init.sh
deleted file mode 100755
index c74a870..0000000
--- a/bin/abrmdcontainer/init.sh
+++ /dev/null
@@ -1,43 +0,0 @@
-#!/bin/bash
-
-set -e
-
-echo "Shared volume is ${ABRMD_DATA}"
-FILE="${ABRMD_DATA}/tpm_status.yaml"
-if [ -f $FILE ];then
-    flag=$(echo "$(cat ${ABRMD_DATA}/tpm_status.yaml)" | sed '/^flag/{s/[^0-9,]//g;y/,/\n/;}')
-    if [ "$flag" == 0 ];then
-        # Start DBUS
-        mkdir -p /var/run/dbus
-        stdbuf -oL -eL dbus-daemon --system --nofork 2>&1 1> /var/log/dbus-daemon.log &
-        # Time for Daemon to start before executin next step
-        sleep 1m
-        # Start Resource Manager
-        if [ -z $TPM_SIMULATOR ]; then
-            echo "Using TPM Hardware for the operations"
-            tpm2-abrmd &
-            # Time for abrmd process to start
-            sleep 1m
-            state=$( ps aux | grep tpm2-abrmd | grep -v grep )
-            echo "Staus of abrmd Process is $state"
-        else
-            echo "Using TPM Simulator for the opeations";
-            hostip=$(ip route show | awk '/default/ {print $3}');
-            echo "Connecting to $hostip\n";
-            tpm2-abrmd -a $hostip -t socket&
-        fi
-
-        /abrmd/bin/initialize_tpm.sh
-        status=$?
-        if [ $status -eq "0" ]; then
-            echo "TPM Initialization successful $status"
-        fi
-        exit $?
-    else
-        echo "TPM is already Initialized"
-        exit;
-    fi
-else
-    echo " TPM Status file not found, Hence exiting"
-    exit;
-fi
diff --git a/bin/abrmdcontainer/initialize_tpm.sh b/bin/abrmdcontainer/initialize_tpm.sh
index 6bd2c32..f9d0b68 100755
--- a/bin/abrmdcontainer/initialize_tpm.sh
+++ b/bin/abrmdcontainer/initialize_tpm.sh
@@ -1,89 +1,50 @@
 #!/bin/sh
 
-# 1.Environmental variables
-
-# 1.a Location of Shared volume and Node's name
-# These varaibles has to be made avaialble to this script
+# Location of Shared volume and Node's name
+# These variables have to be made available to this script
 
 echo "Shared Volume location is $ABRMD_DATA"
 echo "Node name is $TPM_NODE_NAME"
 
-# 2. Create the directory with the host's name to store the output of Init tool
+# 1. Create the directory with the host's name to store the output of Init tool
 # This is demarcate the generated files which are specific to this host's TPM
-srkhandle="$(cat ${ABRMD_DATA}/host_${TPM_NODE_NAME}/srkhandle)"
-passphrase="$(cat ${ABRMD_DATA}/host_${TPM_NODE_NAME}/password-passphrase)"
-echo "${passphrase}" | gpg --batch --yes --passphrase-fd 0 password.txt.gpg
-password="$(cat ${ABRMD_DATA}/host_${TPM_NODE_NAME}/password.txt)"
-
-# 3. Create initial Flag values which are reset upon failure
+mkdir -p ${ABRMD_DATA}/host_${TPM_NODE_NAME}
+WORKDIR=${ABRMD_DATA}/host_${TPM_NODE_NAME}
+cd ${WORKDIR}
+# /abrmd/cred will contain srk_handle and tpm owner hierarchy password
+# provided by the admin of the TPM node
+SRKHANDLE="$(cat /abrmd/cred/srk_handle | base64 -d)"
+
+# 2. Create initial Flag values which are reset upon failure
 error="NULL"
 flag="1"
 
-# 4. TPM initialize
-echo "tpm2_startup -clear -T tabrmd -V"
-tpm2_startup -clear -T tabrmd -V
+# 3. TPM Startup
+echo "tpm2_startup --clear -T device --verbose"
+tpm2_startup --clear -T device -V
 if [ $? -ne 0 ]; then echo; echo -e "${RED}Error, Exit.";
 error=$(echo "TPM Startup failed"); flag="0";
-echo "flag:${flag}" >> ${ABRMD_DATA}/host_${TPM_NODE_NAME}/tpm_status.yaml;
-echo "error:${error}" >> ${ABRMD_DATA}/host_${TPM_NODE_NAME}/tpm_status.yaml;
+echo "flag:${flag}" >> ${WORKDIR}/tpm_status.yaml;
+echo "error:${error}" >> ${WORKDIR}/tpm_status.yaml;
 exit 1;
 fi
 echo ""
 
-# 5. Take ownership
-echo "tpm2_takeownership -o new -e new -l new -T tabrmd -V"
-tpm2_takeownership -o new -e new -l new -T tabrmd -V
-if [ $? -ne 0 ]; then echo; echo -e "${RED}Error, Exit.";
-error=$(echo "Error:TPM ownership acquire failed");flag="0";
-echo "flag:${flag}" >> ${ABRMD_DATA}/host_${TPM_NODE_NAME}/tpm_status.yaml;
-echo "error:${error}" >> ${ABRMD_DATA}/host_${TPM_NODE_NAME}/tpm_status.yaml;
-echo "$error"; exit 1;
-fi
-echo ""
-
-# 6. Create Primary Key in RH_OWNER hierarchy
-rm -f PrimaryKeyBlob
-echo "tpm2_createprimary -P $password -A o -g 0x000B -G 0x0001 -T tabrmd -V -C PrimaryKeyBlob"
-tpm2_createprimary -P $password -A o -g 0x000B -G 0x0001 -T tabrmd -V -C PrimaryKeyBlob
-if [ $? -ne 0 ]; then echo; echo -e "${RED}Error, Exit.";
-error=$(echo "Error: TPM create Primary key failed");
-echo "$error"; flag="0";
-echo "flag:${flag}" >> ${ABRMD_DATA}/host_${TPM_NODE_NAME}/tpm_status.yaml;
-echo "error:${error}" >> ${ABRMD_DATA}/host_${TPM_NODE_NAME}/tpm_status.yaml;
-exit 1;
-fi
-echo ""
-
-# 7. Store Primary Key in TPMs NV RAM
-echo "tpm2_evictcontrol -A o -c ./PrimaryKeyBlob -S ${srkhandle} -T tabrmd -V -P $password"
-tpm2_evictcontrol -A o -c ./PrimaryKeyBlob -S ${srkhandle} -T tabrmd -V -P $password
-if [ $? -ne 0 ]; then echo; echo -e "${RED}Error, Exit.";
-error=$(echo "Error: Inserting Primary Key failed");
-echo "$error"; flag="0";
-echo "flag:${flag}" >> ${ABRMD_DATA}/host_${TPM_NODE_NAME}/tpm_status.yaml;
-echo "errror:${error}" >> ${ABRMD_DATA}/host_${TPM_NODE_NAME}/tpm_status.yaml;
-exit 1;
-fi
-echo ""
-rm -f PrimaryKeyBlob
-
-# 8. To test, Read public portion of TPM primary key with stored handle
-rm -f $out_primary_public
-echo "tpm2_readpublic -H ${srkhandle} --opu out_primary_public -T tabrmd -V"
-tpm2_readpublic -H ${srkhandle} --opu out_primary_public -T tabrmd -V
+# 4. Read public portion of TPM primary key with stored handle
+#    It is expected that the Admin would have created this already
+#    using the create_primary.sh script
+rm -f out_parent_public
+echo "tpm2_readpublic -H ${SRKHANDLE} --opu out_parent_public -T device -V"
+tpm2_readpublic -H ${SRKHANDLE} --opu out_parent_public -T device -V
 if [ $? -ne 0 ]; then echo; echo -e "${RED}Error, Exit.";
 error=$(echo" Error:Reading Public part of Primary Key failed");
 echo "$error"; flag="0";
-echo "flag:${flag}" >> ${ABRMD_DATA}/host_${TPM_NODE_NAME}/tpm_status.yaml;
-echo "error:${error}" >> ${ABRMD_DATA}/host_${TPM_NODE_NAME}/tpm_status.yaml;
+echo "flag:${flag}" >> ${WORKDIR}/tpm_status.yaml;
+echo "error:${error}" >> ${WORKDIR}/tpm_status.yaml;
 exit 1;
 fi
 echo ""
 
-# 9. Update the tpm_status.yaml to report the status of this Script
-echo "flag:${flag}" >> ${ABRMD_DATA}/host_${TPM_NODE_NAME}/tpm_status.yaml
-echo "error:${error}" >> ${ABRMD_DATA}/host_${TPM_NODE_NAME}/tpm_status.yaml
-
-# 10. Copy the public portion of the Primary key to the Shared volume
-# Use environment variable TPM_NODE_NAME
-cp out_parent_public ${ABRMD_DATA}/host_${TPM_NODE_NAME}
+# 5. Update the tpm_status.yaml to report the status of this Script
+echo "flag:${flag}" >> ${WORKDIR}/tpm_status.yaml
+echo "error:${error}" >> ${WORKDIR}/tpm_status.yaml
diff --git a/bin/abrmdcontainer/run_abrmd.sh b/bin/abrmdcontainer/run_abrmd.sh
index bcfb233..00fbf24 100755
--- a/bin/abrmdcontainer/run_abrmd.sh
+++ b/bin/abrmdcontainer/run_abrmd.sh
@@ -3,7 +3,9 @@ set -e
 
 # Start DBUS
 mkdir -p /var/run/dbus
+rm -f /var/run/dbus/*
 stdbuf -oL -eL dbus-daemon --system --nofork 2>&1 1> /var/log/dbus-daemon.log &
+sleep 1m
 
 # Start Resource Manager
 if [ -z $TPM_SIMULATOR ]; then
-- 
cgit 1.2.3-korg