canonical / canonical/secboot

Use Resource Manager (`/dev/tpmrrm0`) rather then `/dev/tpm0`

Open
#222 3 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
23
Forks
29
Avg merge
2d 8h
Merged PRs (30d)
2

Description

Hi,

The snapd reports the following error message when an application snap tries to open up the `/dev/tpm0`.
`stateengine.go:149: state ensure error: devicemgr: cannot connect to TPM: no TPM2 device is available`

Any application snap could block the use of `/dev/tpm0` and therefore, we might consider using the resource manager (`/dev/tpmrmx`) rather than using the `/dev/tpm0` as described here => https://github.com/snapcore/secboot/blob/master/internal/tcti/tcti.go#L29

In addition to that, potentially, we might want to change the snapd's tpm interface to block access to `/dev/tpmx` directly. => https://github.com/snapcore/snapd/blob/master/interfaces/builtin/tpm.go#L36

What do you think?

Thanks,
Bugra

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.