Public bug reported:

[ Impact ]

* On the NVIDIA Jetson Orin platforms (Nano, NX, and AGX) installed with 
candidate Ubuntu for Jetson images (Jammy: 
https://cdimage.ubuntu.com/nvidia-tegra/ubuntu-server/jammy/daily-preinstalled/ 
Noble: 
https://cdimage.ubuntu.com/nvidia-tegra/ubuntu-server/noble/daily-preinstalled/),
 when performing encrypt and decrypt operations using ECC or RSA through 
clevis-encrypt-tpm2, the following error is displayed: "authorizations for 
objects subject to DA protection are not allowed at this time because the TPM 
is in DA lockout mode".
* On the NVIDIA Jetson Orin platforms, the TPM (Trusted Platform Module) is an 
fTPM (Firmware TPM), implemented as an OP-TEE Trusted Application. The "DA 
Lockout" message is not actually been hammered by a dictionary attack, but when 
OP-TEE Secure Storage is unavailable, TPM NVRAM is unavailable so the system 
locks everyone out.
* This error will be fixed properly initializing the TPM, by first starting the 
TEE-supplicant and then installing the "tpm_ftpm_tee" module, using a system-d 
Drop-In file to override the TEE-supplicant initialization sequence. 
TEE-supplicant has been set as a dependency of the "nvidia-tegra-defaults" 
package, for it to be installed in the Ubuntu for Jetson images.


[ Test Plan ]

1. Install the candidate Ubuntu for Jetson image on a Jetson Orin device
(Jammy: https://cdimage.ubuntu.com/nvidia-tegra/ubuntu-
server/jammy/daily-preinstalled/manual/, Noble:
https://cdimage.ubuntu.com/nvidia-tegra/ubuntu-server/noble/daily-
preinstalled/current/).

2. Run the commands below, for both cases (ECC and RSA) the following
error will be displayed: "authorizations for objects subject to DA
protection are not allowed at this time because the TPM is in DA lockout
mode".

   * ECC encrypt and decrypt:

     ```
     $ sudo apt install clevis-tpm2 -y
     $ sudo chmod 666 /dev/tpmrm0
     $ rand=$(cat /dev/urandom | tr -dc 'a-zA-Z0-9' | head -c32768)
     $ result=$(echo -n $rand | clevis-encrypt-tpm2 '{"hash": "sha256", 
"key":"ecc", "pcr_bank":"sha256","pcr_ids":"0,1"}' | clevis-decrypt-tpm2)
     $ [[ $result == $rand ]] && echo "The strings are the same" || echo "there 
was an error"
     ```

   * RSA encrypt and decrypt:

     ```
     $ sudo apt install clevis-tpm2 -y
     $ sudo chmod 666 /dev/tpmrm0
     $ rand=$(cat /dev/urandom | tr -dc 'a-zA-Z0-9' | head -c32768)
     $ result=$(echo -n $rand | clevis-encrypt-tpm2 '{"hash": "sha256", 
"key":"rsa", "pcr_bank":"sha256","pcr_ids":"0,1"}' | clevis-decrypt-tpm2)
     $ [[ $result == $rand ]] && echo "The strings are the same" || echo "there 
was an error"
     ```

     If the following error is displayed when testing the "Noble"
version of this package: "A TPM2 device with the in-kernel resource
manager is needed!", proceed with the steps described in bullet #3.

3. If testing the "Noble" version of the package, ensure to have the
CONFIG_ARM_FFA_TRANSPORT Kernel config symbol set to "y".

   ```
   $ grep CONFIG_ARM_FFA_TRANSPORT /boot/config-$(uname -r)
   CONFIG_ARM_FFA_TRANSPORT=y
   ```

   If CONFIG_ARM_FFA_TRANSPORT is set to "m" the Kernel can be updated
by installing the `linux-nvidia-tegra-ppadev-jetson-devel` package as
shown below.

   ```
   $ sudo add-apt-repository ppa:ubuntu-tegra/kernel-daily
   $ sudo apt update
   $ sudo apt install linux-nvidia-tegra-ppadev-jetson-devel
   $ sudo reboot now
   $ grep CONFIG_ARM_FFA_TRANSPORT /boot/config-$(uname -r)
   CONFIG_ARM_FFA_TRANSPORT=y
   ```

4. Then, proceed installing the updated "nvidia-tegra-defaults" package.

5. Rerun the "encrypt and decrypt" testing instructions described on bullet #2 
and confirm that now the tests succeed.
6. The "Questing" version of the package was tested on a "Noble" image 
following described the instructions for "Noble".


[ Where problems could occur ]

* If a user installs this package on a different platform which doesn't has the 
proper TEE support enabled in the Kernel, the following message can be 
displayed when starting the tee-supplicant service: "failed to find an OP-TEE 
supplicant device".
* If a user installs this package on a different platform which doesn't has the 
"tpm_ftpm_tee" module support, the system-d Drop-In will fail to install such 
Kernel module.
* No additional problems should happen since this fix only ensures that the 
TEE-supplicant is running before installing the "tpm_ftpm_tee" module.


[ Other Info ]

* This tee/tpm initialization sequence was discussed in the following
private bug: https://bugs.launchpad.net/riverside/+bug/2103405

** Affects: nvidia-tegra-defaults (Ubuntu)
     Importance: Undecided
         Status: New

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2119159

Title:
  [SRU] [Nano] [Agx] [Nx] DA Lockout issues when performing encrypt and
  decrypt operations using ECC or RSA through clevis-encrypt-tpm2

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/nvidia-tegra-defaults/+bug/2119159/+subscriptions


-- 
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

Reply via email to