1 /*
2 * The Initial Developer of the Original Code is International
3 * Business Machines Corporation. Portions created by IBM
4 * Corporation are Copyright (C) 2005 International Business
5 * Machines Corporation. All Rights Reserved.
6 *
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the Common Public License as published by
9 * IBM Corporation; either version 1 of the License, or (at your option)
10 * any later version.
11 *
12 * This program is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 * Common Public License for more details.
16 *
17 * You should have received a copy of the Common Public License
18 * along with this program; if not, a copy can be viewed at
19 * http://www.opensource.org/licenses/cpl1.0.php.
20 */
21
22 #include "tpm_tspi.h"
23 #include "tpm_utils.h"
24 #include <getopt.h>
25
26 //controlled by input options
27 static BOOL bCheck = FALSE;
28 static BOOL bRestrict = FALSE;
29 static BOOL isWellKnown = FALSE;
30 TSS_HCONTEXT hContext = 0;
31
parse(const int aOpt,const char * aArg)32 static int parse(const int aOpt, const char *aArg)
33 {
34
35 switch (aOpt) {
36 case 'a':
37 logDebug(_("Changing mode to allow SRK access using SRK auth\n"));
38 bRestrict = FALSE;
39 break;
40 case 's':
41 logDebug(_("Changing mode to check status.\n"));
42 bCheck = TRUE;
43 break;
44 case 'r':
45 logDebug(_("Changing mode to restrist SRK access\n"));
46 bRestrict = TRUE;
47 break;
48 case 'z':
49 logDebug(_("Using TSS_WELL_KNOWN_SECRET to authorize the TPM command\n"));
50 isWellKnown = TRUE;
51 break;
52 default:
53 return -1;
54 }
55 return 0;
56 }
57
help(const char * aCmd)58 static void help(const char *aCmd)
59 {
60
61 logCmdHelp(aCmd);
62 logUnicodeCmdOption();
63 logCmdOption("-a, --allow",
64 _("Allow SRK read access using SRK auth"));
65 logCmdOption("-s, --status", _("Display current status"));
66 logCmdOption("-r, --restrict",
67 _("Restrict SRK read to owner only"));
68 logCmdOption("-z, --well-known",
69 _("Use 20 bytes of zeros (TSS_WELL_KNOWN_SECRET) as the TPM secret authorization data"));
70 }
71
main(int argc,char ** argv)72 int main(int argc, char **argv)
73 {
74
75 char *szTpmPasswd = NULL;
76 int pswd_len;
77 TSS_HPOLICY hTpmPolicy;
78 TSS_HTPM hTpm;
79 int iRc = -1;
80 struct option opts[] = { {"allow", no_argument, NULL, 'a'},
81 {"status", no_argument, NULL, 's'},
82 {"restrict", no_argument, NULL, 'r'},
83 {"well-known", no_argument, NULL, 'z'},
84 };
85 BYTE well_known[TCPA_SHA1_160_HASH_LEN] = TSS_WELL_KNOWN_SECRET;
86
87 initIntlSys();
88
89 if (genericOptHandler
90 (argc, argv, "asrz", opts, sizeof(opts) / sizeof(struct option),
91 parse, help) != 0)
92 goto out;
93
94 /* If no args are given, the default should be to give status */
95 if (argc == 1)
96 bCheck = TRUE;
97
98 //Connect to TSS and TPM
99 if (contextCreate(&hContext) != TSS_SUCCESS)
100 goto out;
101
102 if (contextConnect(hContext) != TSS_SUCCESS)
103 goto out_close;
104
105 if (contextGetTpm(hContext, &hTpm) != TSS_SUCCESS)
106 goto out_close;
107
108 if (isWellKnown) {
109 szTpmPasswd = (char *)well_known;
110 pswd_len = sizeof(well_known);
111 } else {
112 // Prompt for owner password
113 szTpmPasswd = GETPASSWD(_("Enter owner password: "), &pswd_len, FALSE);
114 if (!szTpmPasswd) {
115 logMsg(_("Failed to get password\n"));
116 goto out_close;
117 }
118 }
119 if (policyGet(hTpm, &hTpmPolicy) != TSS_SUCCESS)
120 goto out_close;
121
122 if (policySetSecret
123 (hTpmPolicy, pswd_len, (BYTE *)szTpmPasswd) != TSS_SUCCESS)
124 goto out_close;
125
126 if (bCheck) {
127 TSS_BOOL bValue;
128 if (tpmGetStatus
129 (hTpm, TSS_TPMSTATUS_DISABLEPUBSRKREAD,
130 &bValue) != TSS_SUCCESS)
131 goto out;
132 logMsg(_("Storage Root Key readable with: %s\n"),
133 bValue ? _("owner auth") : _("SRK auth"));
134
135 } else {
136 if (tpmSetStatus(hTpm, TSS_TPMSTATUS_DISABLEPUBSRKREAD, bRestrict)
137 != TSS_SUCCESS)
138 goto out_close;
139 }
140
141 iRc = 0;
142 logSuccess(argv[0]);
143
144 out_close:
145 contextClose(hContext);
146
147 out:
148 if (szTpmPasswd && !isWellKnown)
149 shredPasswd(szTpmPasswd);
150
151 return iRc;
152
153 }
154