1 /* 2 * The Initial Developer of the Original Code is International 3 * Business Machines Corporation. Portions created by IBM 4 * Corporation are Copyright (C) 2005 International Business 5 * Machines Corporation. All Rights Reserved. 6 * 7 * This program is free software; you can redistribute it and/or modify 8 * it under the terms of the Common Public License as published by 9 * IBM Corporation; either version 1 of the License, or (at your option) 10 * any later version. 11 * 12 * This program is distributed in the hope that it will be useful, 13 * but WITHOUT ANY WARRANTY; without even the implied warranty of 14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 15 * Common Public License for more details. 16 * 17 * You should have received a copy of the Common Public License 18 * along with this program; if not, a copy can be viewed at 19 * http://www.opensource.org/licenses/cpl1.0.php. 20 */ 21 22 #include "tpm_tspi.h" 23 #include "tpm_utils.h" 24 25 /* 26 * Affect: Change the TPM state regarding if take_ownership can be performed. 27 * Default: Set state to ownable 28 * Requires: Physical presence 29 */ 30 31 //Controlled by option inputs 32 static TSS_BOOL bValue = TRUE; 33 static BOOL bCheck = FALSE; 34 static BOOL changeRequested = FALSE; 35 static BOOL isWellKnown = FALSE; 36 TSS_HCONTEXT hContext = 0; 37 38 static int parse(const int aOpt, const char *aArg) 39 { 40 41 switch (aOpt) { 42 case 's': 43 logDebug(_("Changing mode to check status.\n")); 44 bCheck = TRUE; 45 break; 46 case 'p': 47 logDebug(_("Changing to prevent ownership mode\n")); 48 bValue = FALSE; 49 changeRequested = TRUE; 50 break; 51 case 'a': 52 logDebug(_("Changing to allow ownership mode\n")); 53 bValue = TRUE; 54 changeRequested = TRUE; 55 break; 56 case 'z': 57 logDebug(_("Using TSS_WELL_KNOWN_SECRET to authorize the TPM command\n")); 58 isWellKnown = TRUE; 59 break; 60 default: 61 return -1; 62 } 63 return 0; 64 } 65 66 static void help(const char *aCmd) 67 { 68 69 logCmdHelp(aCmd); 70 logUnicodeCmdOption(); 71 logCmdOption("-s, --status", _("Display current status")); 72 logCmdOption("-a, --allow", _("Allow TPM takeownership command")); 73 logCmdOption("-p, --prevent", _("Prevent TPM takeownership command")); 74 logCmdOption("-z, --well-known", 75 _("Use 20 bytes of zeros (TSS_WELL_KNOWN_SECRET) as the TPM secret authorization data")); 76 } 77 78 int main(int argc, char **argv) 79 { 80 81 char *szTpmPasswd = NULL; 82 int pswd_len; 83 TSS_HPOLICY hTpmPolicy; 84 TSS_HTPM hTpm; 85 int iRc = -1; 86 struct option opts[] = { {"allow", no_argument, NULL, 'a'}, 87 {"prevent", no_argument, NULL, 'p'}, 88 {"status", no_argument, NULL, 's'}, 89 {"well-known", no_argument, NULL, 'z'}, 90 }; 91 BYTE well_known[] = TSS_WELL_KNOWN_SECRET; 92 93 initIntlSys(); 94 95 if (genericOptHandler 96 (argc, argv, "apsz", opts, sizeof(opts) / sizeof(struct option), 97 parse, help) != 0) 98 goto out; 99 100 if (contextCreate(&hContext) != TSS_SUCCESS) 101 goto out; 102 103 if (contextConnect(hContext) != TSS_SUCCESS) 104 goto out_close; 105 106 if (contextGetTpm(hContext, &hTpm) != TSS_SUCCESS) 107 goto out_close; 108 109 if (bCheck || !changeRequested) { 110 if (isWellKnown) { 111 szTpmPasswd = (char *)well_known; 112 pswd_len = sizeof(well_known); 113 } else { 114 // Prompt for owner password 115 szTpmPasswd = GETPASSWD(_("Enter owner password: "), &pswd_len, FALSE); 116 if (!szTpmPasswd) { 117 logMsg(_("Failed to get password\n")); 118 goto out_close; 119 } 120 } 121 if (policyGet(hTpm, &hTpmPolicy) != TSS_SUCCESS) 122 goto out_close; 123 124 if (policySetSecret 125 (hTpmPolicy, pswd_len, 126 (BYTE *)szTpmPasswd) != TSS_SUCCESS) 127 goto out_close; 128 if (tpmGetStatus 129 (hTpm, TSS_TPMSTATUS_SETOWNERINSTALL, 130 &bValue) != TSS_SUCCESS) 131 goto out_close; 132 133 logMsg(_("Ownable status: %s\n"), logBool(mapTssBool(bValue))); 134 goto out_success; 135 } 136 137 if (tpmSetStatus(hTpm, TSS_TPMSTATUS_SETOWNERINSTALL, bValue) != 138 TSS_SUCCESS) 139 goto out_close; 140 141 out_success: 142 iRc = 0; 143 logSuccess(argv[0]); 144 145 out_close: 146 contextClose(hContext); 147 148 out: 149 if (szTpmPasswd && !isWellKnown) 150 shredPasswd(szTpmPasswd); 151 return iRc; 152 } 153