Create TPM device manager device if available on host

Create the TPM device manager device inside the container if it is
available on the host.

Signed-off-by: Stefan Berger <[email protected]>

Author: stefanberger

libcontainer/vtpm/vtpm-helper/vtpm_helper.go

@@ -5,34 +5,19 @@ package vtpmhelper
 import (
 	"fmt"
 	"os"
+	"syscall"
 
 	"github.com/opencontainers/runc/libcontainer/configs"
+	"github.com/opencontainers/runc/libcontainer/devices"
 	"github.com/opencontainers/runc/libcontainer/vtpm"
 
 	"github.com/opencontainers/runtime-spec/specs-go"
 )
 
-// Create a VTPM
-func CreateVTPM(spec *specs.Spec, config *configs.Config, vtpmdev *specs.VTPM, devnum int, uid int, gid int) error {
-
-	vtpm, err := vtpm.NewVTPM(vtpmdev.Statepath, vtpmdev.TPMVersion, vtpmdev.CreateCertificates)
-	if err != nil {
-		return err
-	}
-
-	// Start the vTPM process; once stopped, the device pair will
-	// also disappear
-	err, createdStatepath := vtpm.Start()
-	if err != nil {
-		return err
-	}
-
-	hostdev := vtpm.GetTPMDevname()
-	major, minor := vtpm.GetMajorMinor()
-
+func addVTPMDevice(spec *specs.Spec, config *configs.Config, devpath string, major, minor uint32) {
 	device := &configs.Device{
 		Type:        'c',
-		Path:        fmt.Sprintf("/dev/tpm%d", devnum),
+		Path:        devpath,
 		Major:       int64(major),
 		Minor:       int64(minor),
 		Permissions: "rwm",
@@ -57,6 +42,28 @@ func CreateVTPM(spec *specs.Spec, config *configs.Config, vtpmdev *specs.VTPM, d
 		Access: "rwm",
 	}
 	spec.Linux.Resources.Devices = append(spec.Linux.Resources.Devices, *ld)
+}
+
+// Create a VTPM
+func CreateVTPM(spec *specs.Spec, config *configs.Config, vtpmdev *specs.VTPM, devnum int, uid int, gid int) error {
+
+	vtpm, err := vtpm.NewVTPM(vtpmdev.Statepath, vtpmdev.TPMVersion, vtpmdev.CreateCertificates)
+	if err != nil {
+		return err
+	}
+
+	// Start the vTPM process; once stopped, the device pair will
+	// also disappear
+	err, createdStatepath := vtpm.Start()
+	if err != nil {
+		return err
+	}
+
+	hostdev := vtpm.GetTPMDevname()
+	major, minor := vtpm.GetMajorMinor()
+
+	devpath := fmt.Sprintf("/dev/tpm%d", devnum)
+	addVTPMDevice(spec, config, devpath, major, minor)
 
 	config.VTPMs = append(config.VTPMs, vtpm)
 
@@ -68,6 +75,23 @@ func CreateVTPM(spec *specs.Spec, config *configs.Config, vtpmdev *specs.VTPM, d
 		}
 	}
 
+	// check if /dev/vtpmrm%d is available
+	host_tpmrm := fmt.Sprintf("/dev/tpmrm%d", vtpm.GetTPMDevNum())
+	if fileInfo, err := os.Lstat(host_tpmrm); err == nil {
+		if stat_t, ok := fileInfo.Sys().(*syscall.Stat_t); ok {
+			devNumber := int(stat_t.Rdev)
+			devpath = fmt.Sprintf("/dev/tpmrm%d", devnum)
+			addVTPMDevice(spec, config, devpath, uint32(devices.Major(devNumber)), uint32(devices.Minor(devNumber)))
+		}
+		if uid != 0 {
+			// adapt ownership of the device since only root can access it
+			if err := os.Chown(host_tpmrm, uid, gid); err != nil {
+				vtpm.Stop(createdStatepath)
+				return err
+			}
+		}
+	}
+
 	return nil
 }