1 /*
2 * The Initial Developer of the Original Code is International
3 * Business Machines Corporation. Portions created by IBM
4 * Corporation are Copyright (C) 2005 International Business
5 * Machines Corporation. All Rights Reserved.
6 *
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the Common Public License as published by
9 * IBM Corporation; either version 1 of the License, or (at your option)
10 * any later version.
11 *
12 * This program is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 * Common Public License for more details.
16 *
17 * You should have received a copy of the Common Public License
18 * along with this program; if not, a copy can be viewed at
19 * http://www.opensource.org/licenses/cpl1.0.php.
20 */
21
22 #include "tpm_tspi.h"
23 #include "tpm_utils.h"
24
25 /*
26 * Affect: Change the TPM state regarding if take_ownership can be performed.
27 * Default: Set state to ownable
28 * Requires: Physical presence
29 */
30
31 //Controlled by option inputs
32 static TSS_BOOL bValue = TRUE;
33 static BOOL bCheck = FALSE;
34 static BOOL changeRequested = FALSE;
35 static BOOL isWellKnown = FALSE;
36 TSS_HCONTEXT hContext = 0;
37
parse(const int aOpt,const char * aArg)38 static int parse(const int aOpt, const char *aArg)
39 {
40
41 switch (aOpt) {
42 case 's':
43 logDebug(_("Changing mode to check status.\n"));
44 bCheck = TRUE;
45 break;
46 case 'p':
47 logDebug(_("Changing to prevent ownership mode\n"));
48 bValue = FALSE;
49 changeRequested = TRUE;
50 break;
51 case 'a':
52 logDebug(_("Changing to allow ownership mode\n"));
53 bValue = TRUE;
54 changeRequested = TRUE;
55 break;
56 case 'z':
57 logDebug(_("Using TSS_WELL_KNOWN_SECRET to authorize the TPM command\n"));
58 isWellKnown = TRUE;
59 break;
60 default:
61 return -1;
62 }
63 return 0;
64 }
65
help(const char * aCmd)66 static void help(const char *aCmd)
67 {
68
69 logCmdHelp(aCmd);
70 logUnicodeCmdOption();
71 logCmdOption("-s, --status", _("Display current status"));
72 logCmdOption("-a, --allow", _("Allow TPM takeownership command"));
73 logCmdOption("-p, --prevent", _("Prevent TPM takeownership command"));
74 logCmdOption("-z, --well-known",
75 _("Use 20 bytes of zeros (TSS_WELL_KNOWN_SECRET) as the TPM secret authorization data"));
76 }
77
main(int argc,char ** argv)78 int main(int argc, char **argv)
79 {
80
81 char *szTpmPasswd = NULL;
82 int pswd_len;
83 TSS_HPOLICY hTpmPolicy;
84 TSS_HTPM hTpm;
85 int iRc = -1;
86 struct option opts[] = { {"allow", no_argument, NULL, 'a'},
87 {"prevent", no_argument, NULL, 'p'},
88 {"status", no_argument, NULL, 's'},
89 {"well-known", no_argument, NULL, 'z'},
90 };
91 BYTE well_known[] = TSS_WELL_KNOWN_SECRET;
92
93 initIntlSys();
94
95 if (genericOptHandler
96 (argc, argv, "apsz", opts, sizeof(opts) / sizeof(struct option),
97 parse, help) != 0)
98 goto out;
99
100 if (contextCreate(&hContext) != TSS_SUCCESS)
101 goto out;
102
103 if (contextConnect(hContext) != TSS_SUCCESS)
104 goto out_close;
105
106 if (contextGetTpm(hContext, &hTpm) != TSS_SUCCESS)
107 goto out_close;
108
109 if (bCheck || !changeRequested) {
110 if (isWellKnown) {
111 szTpmPasswd = (char *)well_known;
112 pswd_len = sizeof(well_known);
113 } else {
114 // Prompt for owner password
115 szTpmPasswd = GETPASSWD(_("Enter owner password: "), &pswd_len, FALSE);
116 if (!szTpmPasswd) {
117 logMsg(_("Failed to get password\n"));
118 goto out_close;
119 }
120 }
121 if (policyGet(hTpm, &hTpmPolicy) != TSS_SUCCESS)
122 goto out_close;
123
124 if (policySetSecret
125 (hTpmPolicy, pswd_len,
126 (BYTE *)szTpmPasswd) != TSS_SUCCESS)
127 goto out_close;
128 if (tpmGetStatus
129 (hTpm, TSS_TPMSTATUS_SETOWNERINSTALL,
130 &bValue) != TSS_SUCCESS)
131 goto out_close;
132
133 logMsg(_("Ownable status: %s\n"), logBool(mapTssBool(bValue)));
134 goto out_success;
135 }
136
137 if (tpmSetStatus(hTpm, TSS_TPMSTATUS_SETOWNERINSTALL, bValue) !=
138 TSS_SUCCESS)
139 goto out_close;
140
141 out_success:
142 iRc = 0;
143 logSuccess(argv[0]);
144
145 out_close:
146 contextClose(hContext);
147
148 out:
149 if (szTpmPasswd && !isWellKnown)
150 shredPasswd(szTpmPasswd);
151 return iRc;
152 }
153