1 /* 2 * The Initial Developer of the Original Code is International 3 * Business Machines Corporation. Portions created by IBM 4 * Corporation are Copyright (C) 2005 International Business 5 * Machines Corporation. All Rights Reserved. 6 * 7 * This program is free software; you can redistribute it and/or modify 8 * it under the terms of the Common Public License as published by 9 * IBM Corporation; either version 1 of the License, or (at your option) 10 * any later version. 11 * 12 * This program is distributed in the hope that it will be useful, 13 * but WITHOUT ANY WARRANTY; without even the implied warranty of 14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 15 * Common Public License for more details. 16 * 17 * You should have received a copy of the Common Public License 18 * along with this program; if not, a copy can be viewed at 19 * http://www.opensource.org/licenses/cpl1.0.php. 20 */ 21 22 #include "tpm_tspi.h" 23 #include "tpm_utils.h" 24 #include <getopt.h> 25 26 //controlled by input options 27 static BOOL bCheck = FALSE; 28 static BOOL bRestrict = FALSE; 29 static BOOL isWellKnown = FALSE; 30 TSS_HCONTEXT hContext = 0; 31 32 static int parse(const int aOpt, const char *aArg) 33 { 34 35 switch (aOpt) { 36 case 'a': 37 logDebug(_("Changing mode to allow SRK access using SRK auth\n")); 38 bRestrict = FALSE; 39 break; 40 case 's': 41 logDebug(_("Changing mode to check status.\n")); 42 bCheck = TRUE; 43 break; 44 case 'r': 45 logDebug(_("Changing mode to restrist SRK access\n")); 46 bRestrict = TRUE; 47 break; 48 case 'z': 49 logDebug(_("Using TSS_WELL_KNOWN_SECRET to authorize the TPM command\n")); 50 isWellKnown = TRUE; 51 break; 52 default: 53 return -1; 54 } 55 return 0; 56 } 57 58 static void help(const char *aCmd) 59 { 60 61 logCmdHelp(aCmd); 62 logUnicodeCmdOption(); 63 logCmdOption("-a, --allow", 64 _("Allow SRK read access using SRK auth")); 65 logCmdOption("-s, --status", _("Display current status")); 66 logCmdOption("-r, --restrict", 67 _("Restrict SRK read to owner only")); 68 logCmdOption("-z, --well-known", 69 _("Use 20 bytes of zeros (TSS_WELL_KNOWN_SECRET) as the TPM secret authorization data")); 70 } 71 72 int main(int argc, char **argv) 73 { 74 75 char *szTpmPasswd = NULL; 76 int pswd_len; 77 TSS_HPOLICY hTpmPolicy; 78 TSS_HTPM hTpm; 79 int iRc = -1; 80 struct option opts[] = { {"allow", no_argument, NULL, 'a'}, 81 {"status", no_argument, NULL, 's'}, 82 {"restrict", no_argument, NULL, 'r'}, 83 {"well-known", no_argument, NULL, 'z'}, 84 }; 85 BYTE well_known[TCPA_SHA1_160_HASH_LEN] = TSS_WELL_KNOWN_SECRET; 86 87 initIntlSys(); 88 89 if (genericOptHandler 90 (argc, argv, "asrz", opts, sizeof(opts) / sizeof(struct option), 91 parse, help) != 0) 92 goto out; 93 94 /* If no args are given, the default should be to give status */ 95 if (argc == 1) 96 bCheck = TRUE; 97 98 //Connect to TSS and TPM 99 if (contextCreate(&hContext) != TSS_SUCCESS) 100 goto out; 101 102 if (contextConnect(hContext) != TSS_SUCCESS) 103 goto out_close; 104 105 if (contextGetTpm(hContext, &hTpm) != TSS_SUCCESS) 106 goto out_close; 107 108 if (isWellKnown) { 109 szTpmPasswd = (char *)well_known; 110 pswd_len = sizeof(well_known); 111 } else { 112 // Prompt for owner password 113 szTpmPasswd = GETPASSWD(_("Enter owner password: "), &pswd_len, FALSE); 114 if (!szTpmPasswd) { 115 logMsg(_("Failed to get password\n")); 116 goto out_close; 117 } 118 } 119 if (policyGet(hTpm, &hTpmPolicy) != TSS_SUCCESS) 120 goto out_close; 121 122 if (policySetSecret 123 (hTpmPolicy, pswd_len, (BYTE *)szTpmPasswd) != TSS_SUCCESS) 124 goto out_close; 125 126 if (bCheck) { 127 TSS_BOOL bValue; 128 if (tpmGetStatus 129 (hTpm, TSS_TPMSTATUS_DISABLEPUBSRKREAD, 130 &bValue) != TSS_SUCCESS) 131 goto out; 132 logMsg(_("Storage Root Key readable with: %s\n"), 133 bValue ? _("owner auth") : _("SRK auth")); 134 135 } else { 136 if (tpmSetStatus(hTpm, TSS_TPMSTATUS_DISABLEPUBSRKREAD, bRestrict) 137 != TSS_SUCCESS) 138 goto out_close; 139 } 140 141 iRc = 0; 142 logSuccess(argv[0]); 143 144 out_close: 145 contextClose(hContext); 146 147 out: 148 if (szTpmPasswd && !isWellKnown) 149 shredPasswd(szTpmPasswd); 150 151 return iRc; 152 153 } 154