Skip to content

azure: TCTI is hardcoded to the raw /dev/tpm0 device #72

Description

@samlaf

crates/attestation/src/azure/nv_index.rs builds its TSS context with the
hardcoded default TCTI:

let conf: TctiNameConf = TctiNameConf::Device(DeviceConfig::default());

DeviceConfig::default() is the raw /dev/tpm0 device, which the kernel
hands to one client at a time: any other TPM user on the machine
(tpm2-tools, systemd, a second evidence-generating process) makes context
creation fail with a device-busy error, and vice versa. The kernel's TPM
resource manager (/dev/tpmrm0) multiplexes clients, but there is
currently no way to select it.

Proposal: resolve the TCTI via TctiNameConf::from_environment_variable()
(which honors the conventional TPM2TOOLS_TCTI / TCTI variables, e.g.
device:/dev/tpmrm0) and keep the current default as fallback — no
behavior change unless the variable is set.

Note the azure evidence path also reaches the same hardcoded pattern
upstream through az_tdx_vtpm::vtpm (az-cvm-vtpm src/vtpm/mod.rs), so
fully honoring the variable needs the matching upstream change too — filed
as kinvolk/azure-cvm-tooling#92.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions