Skip to content

azure: TCTI is hardcoded to the raw /dev/tpm0 device #72

Description

@samlaf

crates/attestation/src/azure/nv_index.rs builds its TSS context with the
hardcoded default TCTI:

let conf: TctiNameConf = TctiNameConf::Device(DeviceConfig::default());

DeviceConfig::default() is the raw /dev/tpm0 device, which the kernel
hands to one client at a time: any other TPM user on the machine
(tpm2-tools, systemd, a second evidence-generating process) makes context
creation fail with a device-busy error, and vice versa. The kernel's TPM
resource manager (/dev/tpmrm0) multiplexes clients, but there is
currently no way to select it.

Proposal: resolve the TCTI via TctiNameConf::from_environment_variable()
(which honors the conventional TPM2TOOLS_TCTI / TCTI variables, e.g.
device:/dev/tpmrm0) and keep the current default as fallback — no
behavior change unless the variable is set.

Note the azure evidence path also reaches the same hardcoded pattern
upstream through az_tdx_vtpm::vtpm (az-cvm-vtpm src/vtpm/mod.rs), so
fully honoring the variable needs the matching upstream change too — filed
as kinvolk/azure-cvm-tooling#92.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions