Skip to content

azure: TCTI is hardcoded to the raw /dev/tpm0 device #72

Description

@samlaf

crates/attestation/src/azure/nv_index.rs builds its TSS context with the
hardcoded default TCTI:

let conf: TctiNameConf = TctiNameConf::Device(DeviceConfig::default());

DeviceConfig::default() is the raw /dev/tpm0 device, which the kernel
hands to one client at a time: any other TPM user on the machine
(tpm2-tools, systemd, a second evidence-generating process) makes context
creation fail with a device-busy error, and vice versa. The kernel's TPM
resource manager (/dev/tpmrm0) multiplexes clients, but there is
currently no way to select it.

Proposal: resolve the TCTI via TctiNameConf::from_environment_variable()
(which honors the conventional TPM2TOOLS_TCTI / TCTI variables, e.g.
device:/dev/tpmrm0) and keep the current default as fallback — no
behavior change unless the variable is set.

Note the azure evidence path also reaches the same hardcoded pattern
upstream through az_tdx_vtpm::vtpm (az-cvm-vtpm src/vtpm/mod.rs), so
fully honoring the variable needs the matching upstream change too — filed
as kinvolk/azure-cvm-tooling#92.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Fields

    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions