[Bug 1187925] New: any tpm2 command kills tpm2-abrmd service
http://bugzilla.opensuse.org/show_bug.cgi?id=1187925 Bug ID: 1187925 Summary: any tpm2 command kills tpm2-abrmd service Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: screening-team-bugs@suse.de Reporter: aplanas@suse.com QA Contact: qa-bugs@suse.de Found By: --- Blocker: --- Any TPM2 command kills the tpm2-abrmd service, ending it with an Exit 74. # Start the service from the command line: # sudo -u tss G_MESSAGES_DEBUG=all /usr/sbin/tpm2-abrmd # Execute a tpm2 command # tpm2_startup -c ** (process:1277): WARNING **: 14:54:45.022: Failed to create connection with service: GDBus.Error:org.freedesktop.DBus.Error.NoReply: Message recipient disconnected from message bus without replying WARNING:tcti:src/tss2-tcti/tctildr.c:79:tcti_from_init() TCTI init for function 0x7fab3188edb0 failed with a0008 WARNING:tcti:src/tss2-tcti/tctildr.c:109:tcti_from_info() Could not initialize TCTI named: tcti-abrmd ERROR:tcti:src/tss2-tcti/tctildr-dl.c:154:tcti_from_file() Could not initialize TCTI file: libtss2-tcti-tabrmd.so.0 The log from the tpm2-abrmd: ** (tpm2-abrmd:1265): DEBUG: 14:54:45.009: Creating connection with id: 0x9093846a53943695 ** (tpm2-abrmd:1265): DEBUG: 14:54:45.009: handle_map_new with handle_type 0x80, max_entries: 0x1b ** (tpm2-abrmd:1265): DEBUG: 14:54:45.009: handle_map_init ** (tpm2-abrmd:1265): DEBUG: 14:54:45.009: handle_map_set_property: max-entries: 27 ** (tpm2-abrmd:1265): DEBUG: 14:54:45.009: connection_class_init ** (tpm2-abrmd:1265): DEBUG: 14:54:45.009: connection_set_property ** (tpm2-abrmd:1265): DEBUG: 14:54:45.009: connection_set_property: set id to 0x9093846a53943695 ** (tpm2-abrmd:1265): DEBUG: 14:54:45.009: connection_set_property ** (tpm2-abrmd:1265): DEBUG: 14:54:45.009: connection_set_property: set socket ** (tpm2-abrmd:1265): DEBUG: 14:54:45.009: connection_set_property ** (tpm2-abrmd:1265): DEBUG: 14:54:45.009: connection_set_property: set transient_handle_map ** (tpm2-abrmd:1265): DEBUG: 14:54:45.009: Created connection with client FD: 9 and id: 0x9093846a53943695 ** INFO: 14:54:45.009: command_source_on_new_connection: adding new connection ** (tpm2-abrmd:1265): DEBUG: 14:54:45.011: command_source_on_input_ready ** (tpm2-abrmd:1265): DEBUG: 14:54:45.011: read_data: reading 10 bytes from istream ** (tpm2-abrmd:1265): DEBUG: 14:54:45.011: read produced EOF ** (tpm2-abrmd:1265): DEBUG: 14:54:45.011: read_tpm_buffer_alloc: err_out freeing buffer ** (tpm2-abrmd:1265): DEBUG: 14:54:45.011: command_source_on_input_ready: removing connection from connection_manager ** (tpm2-abrmd:1265): DEBUG: 14:54:45.011: connection_manager_remove: removing Connection ** (tpm2-abrmd:1265): DEBUG: 14:54:45.011: sink_enqueue ** (tpm2-abrmd:1265): DEBUG: 14:54:45.011: resource_manager_enqueue ** (tpm2-abrmd:1265): DEBUG: 14:54:45.011: message_queue_enqueue ** (tpm2-abrmd:1265): DEBUG: 14:54:45.011: command_source_on_input_ready: removing GCancellable ** (tpm2-abrmd:1265): DEBUG: 14:54:45.011: resource_manager_thread: message_queue_dequeue got obj ** (tpm2-abrmd:1265): DEBUG: 14:54:45.011: resource_manager_process_control ** (tpm2-abrmd:1265): DEBUG: 14:54:45.011: resource_manager_process_control: received CONNECTION_REMOVED message for connection ** INFO: 14:54:45.011: resource_manager_remove_connection: flushing session contexts ** (tpm2-abrmd:1265): DEBUG: 14:54:45.012: resource_manager_remove_connection: done ** (tpm2-abrmd:1265): DEBUG: 14:54:45.012: sink_enqueue ** (tpm2-abrmd:1265): DEBUG: 14:54:45.012: response_sink_enqueue: ** (tpm2-abrmd:1265): DEBUG: 14:54:45.012: message_queue_enqueue ** (tpm2-abrmd:1265): DEBUG: 14:54:45.012: message_queue_dequeue ** (tpm2-abrmd:1265): DEBUG: 14:54:45.012: response_sink_process_control ** (tpm2-abrmd:1265): DEBUG: 14:54:45.012: response_sink_process_control: Received CONNECTION_REMOVED message, nothing to do. ** (tpm2-abrmd:1265): DEBUG: 14:54:45.012: handle_map_finalize ** (tpm2-abrmd:1265): DEBUG: 14:54:45.012: response_sink_thread: blocking on input queue ** (tpm2-abrmd:1265): DEBUG: 14:54:45.012: message_queue_dequeue ** (tpm2-abrmd:1265): DEBUG: 14:54:45.013: on_name_lost: com.intel.tss2.Tabrmd ** INFO: 14:54:45.013: main_loop_quit ** INFO: 14:54:45.013: g_main_loop_run done, cleaning up ** (tpm2-abrmd:1265): DEBUG: 14:54:45.014: gmain_data_cleanup ** (tpm2-abrmd:1265): DEBUG: 14:54:45.014: command_attrs_finalize ** (tpm2-abrmd:1265): DEBUG: 14:54:45.014: resource_manager_unblock: enqueuing ControlMessage ** (tpm2-abrmd:1265): DEBUG: 14:54:45.014: message_queue_enqueue ** (tpm2-abrmd:1265): DEBUG: 14:54:45.015: resource_manager_thread: message_queue_dequeue got obj ** (tpm2-abrmd:1265): DEBUG: 14:54:45.015: resource_manager_process_control ** (tpm2-abrmd:1265): DEBUG: 14:54:45.015: sink_enqueue ** (tpm2-abrmd:1265): DEBUG: 14:54:45.015: response_sink_enqueue: ** (tpm2-abrmd:1265): DEBUG: 14:54:45.015: message_queue_enqueue ** (tpm2-abrmd:1265): DEBUG: 14:54:45.015: response_sink_process_control ** (tpm2-abrmd:1265): DEBUG: 14:54:45.015: response_sink_process_control: Received CHECK_CANCEL control code, terminating. ** (tpm2-abrmd:1265): DEBUG: 14:54:45.015: resource_manager_dispose ** (tpm2-abrmd:1265): DEBUG: 14:54:45.015: session_list_dispose: SessionList with 0 entries ** (tpm2-abrmd:1265): DEBUG: 14:54:45.016: session_list_finalize: SessionList with 0 entries ** (tpm2-abrmd:1265): DEBUG: 14:54:45.016: message_queue_enqueue ** (tpm2-abrmd:1265): DEBUG: 14:54:45.016: ipc_frontend_disconnect ** (tpm2-abrmd:1265): DEBUG: 14:54:45.017: random_finalize ** INFO: 14:54:45.017: main_loop_quit [1]+ Exit 74 sudo -u tss G_MESSAGES_DEBUG=all /usr/sbin/tpm2-abrmd I think that all the TCTI relevant packages are installed: # zypper se -i tcti Loading repository data... Reading installed packages... S | Name | Summary | Type ---+----------------------+-----------------------------------------------------------+-------- i | libtss2-tcti-device0 | TCTI interface library for using a native TPM device node | package i+ | libtss2-tcti-tabrmd0 | Client interface library for tpm2-abrmd | package i | libtss2-tctildr0 | TCTI interface loading library | package -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=1187925 Alberto Planas Dominguez <aplanas@suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|screening-team-bugs@suse.de |matthias.gerstner@suse.com -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=1187925 http://bugzilla.opensuse.org/show_bug.cgi?id=1187925#c1 --- Comment #1 from Alberto Planas Dominguez <aplanas@suse.com> --- I reported in upstream too: https://github.com/tpm2-software/tpm2-abrmd/issues/783 -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=1187925 http://bugzilla.opensuse.org/show_bug.cgi?id=1187925#c2 --- Comment #2 from Alberto Planas Dominguez <aplanas@suse.com> --- Oh my. Is a selinux problem. """ type=MAC_STATUS msg=audit(1625226646.416:118): enforcing=1 old_enforcing=0 auid=0 ses=1 enabled=1 old-enabled=1 lsm=selinux res=1^]AUID="root" """ Was hard to find as seems to be under a dontaudit rule, and was hidden form the logs. So as I see it there are two problems: the selinux have too many dontaudit rules, that hide the denial, and the policy itself. -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=1187925 http://bugzilla.opensuse.org/show_bug.cgi?id=1187925#c5 Alberto Planas Dominguez <aplanas@suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|matthias.gerstner@suse.com |jsegitz@suse.com --- Comment #5 from Alberto Planas Dominguez <aplanas@suse.com> --- Seems that the project provides some selinux rules: https://github.com/tpm2-software/tpm2-abrmd/tree/master/selinux Is there a canonical way to include it in selinux-policy package? -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=1187925 http://bugzilla.opensuse.org/show_bug.cgi?id=1187925#c6 --- Comment #6 from Alberto Planas Dominguez <aplanas@suse.com> --- I tested this and fix the issue: https://build.opensuse.org/request/show/904418 -- You are receiving this mail because: You are on the CC list for the bug.
participants (1)
-
bugzilla_noreply＠suse.com