Preview: Add vTPM support for Linux

[stefanberger]

This patch adds vTPM support for Linux to libcontainer.

The functionality is based on a recently added vtpm_proxy driver, which is becoming
available in Linux 4.8. The driver provides /dev/vtpmx, on which an ioctl is called
that spawns a TPM device in the host's /dev directory and returns an anonymous file-
descriptor on which a TPM emulator can listen for TPM commands. If we for example
created /dev/tpm12 on the host we make this device available as /dev/tpm0 inside the
container. We also add its major and minor numbers to the device cgroup.

We implement a VTPM class that allows us to create the device and starts a TPM
emulator 'swtpm', to which it passes the anonymous file descriptor.
Besides that, the user can choose to have the vTPM create certificates in a step
that simulates TPM manufacturing. We do this by calling the external swtpm_setup
program, which is part of the swtpm project.

VTPM support is added inside the JSON configuration as follows:

[...]
    "linux": {
        "resources": {
            "devices": [
                {
                    "allow": false,
                    "access": "rwm"
                }
            ] ,
            "vtpms": [
                {
                    "statePath": "/tmp/tpm-1",
                    "createCerts": true,
                },
            ]
        },

This JSON markup makes a single TPM available inside the created container.

o The Statpath parameter indicates the directory where the TPM emulator 'swtpm'
writes the state of the TPM device to.
o The CreateCertificates parameter indicates that certificates for the TPM are
to be created.

The swtpm project is available here : https://github.com/stefanberger/swtpm
The libtpms project is available here: https://github.com/stefanberger/libtpms

Signed-off-by: Stefan Berger stefanb@linux.vnet.ibm.com

[cyphar]

Can you add a link to the corresponding PR in the runtime-spec?

[stefanberger]

@cyphar I haven't sent a PR to the run-time spec, yet. Since this is a 'preview' I thought I'd just keep the all the changes, also the ones for the run-time spec, in this PR here ...

[stefanberger]

So here's the status of the code:

One can add several (v)TPMs to a container. For each vTPM a 'swtpm' process and vtpm_proxy device pair is spawned via an ioctl on /dev/vtpmx.

One can then start the TPM Software Stack (TSS, TrouSerS) inside a container. For this I am using a Fedora container in which I previously installed trousers and tpm-tools packages. To be able to start the TSS stack inside the container (as root) I found it necessary to add CAP_DAC_OVERRIDE to the capabilities in the config.json of my container:

 [...]
            "cwd": "/",
            "capabilities": [
                    "CAP_AUDIT_WRITE",
                    "CAP_KILL",
                    "CAP_NET_BIND_SERVICE",
                    "CAP_DAC_OVERRIDE"
            ],
 [...]

Besides that I enabled two vTPMs in config.json:

 [...]
            "resources": {
                    "devices": [
                            {
                                    "allow": false,
                                    "access": "rwm"
                            }
                    ] ,
                    "vtpms": [
                            {
                                    "statePath": "/tmp/foobar",
                                    "createCerts" : true
                            },
                            {
                                    "statePath": "/tmp/foobar2",
                                    "createCerts" : true
                            }
                    ]
            },
 [...]

Then it is possible to do the following:

[root@host mycontainer]# runc create test
[root@host mycontainer]# runc exec -t test bash
[root@runc /]# ls -l /dev/tpm*
crw-------. 1 root root  10, 224 Sep 29 13:51 /dev/tpm0
crw-------. 1 root root 254,   1 Sep 29 13:51 /dev/tpm1
[root@runc /]# tcsd -f &
[1] 24
[root@runc /]# TCSD TDDL ioctl: (25) Inappropriate ioctl for device
TCSD TDDL Falling back to Read/Write device support.
TCSD trousers 0.3.13: TCSD up and running.

[root@runc /]# tpm_takeownership
Enter owner password:
Confirm password:
Enter SRK password:
Confirm password:
[root@runc /]# tpm_clear
Enter owner password:
TPM Successfuly Cleared.  You need to reboot to complete this operation.  After reboot the TPM will be in the default state: unowned, disabled and inactive.
[root@runc /]# exit
exit
[root@host mycontainer]# ps aux | grep swtpm
tss       6296  1.6  0.0  31664  3620 ?        Ss   09:46   0:00 swtpm chardev --tpmstate dir=/tmp/foobar --daemon --fd 5 --pid file=/tmp/foobar/swtpm.pid --log file=/tmp/foobar/swtpm.log --runas tss
tss       6336  0.4  0.0  31664  3676 ?        Ss   09:47   0:00 swtpm chardev --tpmstate dir=/tmp/foobar2 --daemon --fd 6 --pid file=/tmp/foobar2/swtpm.pid --log file=/tmp/foobar2/swtpm.log --runas tss
root      6379  0.0  0.0 114328  2300 pts/0    S+   09:47   0:00 grep --color=auto swtpm
[root@host mycontainer]# runc delete test
[root@host mycontainer]# ps aux | grep swtpm
root      6389  0.0  0.0 114328  2096 pts/0    S+   09:47   0:00 grep --color=auto swtpm

Once ownership of the vTPM has been given up, the container would have to be delete and created again, since the vTPM needs to be reset.

[mrunalp]

@stefanberger Thanks for the PR. I would suggest that you open a PR to runtime-spec as well if you want to try to get this included in the 1.0 version of the spec which is getting closer. We can't really merge anything here without the spec changes being upstreamed first. We can of course review your changes meanwhile.

[stefanberger]

@mrunalp If you want to review the changes in the meantime, that would be helpful.

[mrunalp]

nit: error string that aren't logged start with lower case.

[mrunalp]

We could probably take out the debugs from the library.

[mrunalp]

@stefanberger I am trying to test this on Fedora Rawhide on (4.8 rc4 kernel). What do I have to do to install/enable VTPM driver?

[stefanberger]

@mrunalp

1. The Linux kernel has to be compiled with CONFIG_TCG_VTPM_PROXY either as module or built-in.
2. Libtpms from Fedora can unfortunately currently not be used due to this bug here: https://bugzilla.redhat.com/show_bug.cgi?id=1385290

Instead one would have to git clone it from my git repo: https://github.com/stefanberger/libtpms/

git clone https://github.com/stefanberger/libtpms.git
cd libtpms
./bootstrap.sh
dnf builddep dist/libtpms.spec
./configure --prefix=/usr --with-openssl
make
make install

3. swtpm is not packaged for Fedora, yet, so do the following

git clone https://github.com/stefanberger/swtpm.git
cd swtpm
./bootstrap.sh
dnf builddep dist/swtpm.spec
./configure --prefix=/usr --with-openssl
make
make install

[stefanberger]

Regarding the need for CAP_DAC_OVERRIDE: This requirement is needed in the above 'demo' because 'tcsd' requires that /etc/tcsd.conf is owned by tss:tss. Therefore, it's not possible to just change the owner of this file to root:root because then tcsd will not run.

TCSD ERROR: TCSD config file (/etc/tcsd.conf) must be user/group tss/tss.

PS: Docker also sets CAP_DAC_OVERRIDE by default as one of the capabilities in the containers, so it would run there: https://github.com/docker/docker/blob/v1.12.3/oci/defaults_linux.go#L63

[mrunalp]

Needs rebase.

[deitch]

@mrunalp it does... but will @stefanberger do it? He is a great guy, putting in all this work, but if I had been the one who opened the PR, I would be loathe to rebase unless someone on the runc team told me they would merge it in once it is rebased.

[stefanberger]

@deitch I will do the rebase. Give me some time. I have to catch up with other things after vacation. I also want to see it working in QEMU as well.
I sent this pull request a while ago but so far not having it integrated has worked to the benefit of being able to extend swtpm etc.

[Mashimiao]

Thanks for your catch. fixing in #1587

[deitch]

Why did we close?

[stefanberger]

I did not close this by going to this page. Maybe because I pushed the runtime-spec's vtpm branch over this branch here...

[crosbymichael]

@stefanberger i cannot reopen, its not allowing me to.

[stefanberger]

Opened this again as PR #1591.