Skip to content

Incorrect Exception Return in FAPI #661

Description

@williamcroberts

Using this program the reported exception is, "tpm2_pytss.TSS2_Exception.TSS2_Exception: tpm:parameter(1):value is out of range or is not correct for the context"

However, I would expect a policy/auth failure exception instead

#!/usr/bin/env python
# SPDX-License-Identifier: 0BSD

import os
from contextlib import ExitStack
from textwrap import dedent as DD

from tpm2_pytss import FAPI, FAPIConfig, TSS2_Exception

# we use ExitStack so we don't have to double nest with statements
with ExitStack() as stack:
    # Set up the config for the environment
    stack.enter_context(
        FAPIConfig(
            temp_dirs=True,
            tcti=os.environ.get("TPM2TOOLS_TCTI"),
            ek_cert_less="yes",
            profile_name="P_RSA2048SHA256",
            firmware_log_file="/dev/null",
            ima_log_file="/dev/null",
        )
    )

    # Create a FAPI instance and add it to our stack
    f = stack.enter_context(FAPI())

    # Provision it, defaults are OK here
    f.provision()

    # Create a JSON Policy File
    json_policy = DD(
    """
    {
      "description":"Policy PCR for PCR 16",

      "policy":[
         {
           "type":"POLICYPCR",
           "currentPCRs": [ 16 ]
         }
       ]
    }
    """)

    # Import that Policy
    f.import_object("/policy/my_policy", json_policy)

    # Seal some data, convert the string to bytes with encode
    f.create_seal(
        "/SRK/my_seal", data="Hello World".encode(), policy_path="/policy/my_policy")

    # Unseal that data
    unsealed = f.unseal("/SRK/my_seal")

    # decode that sealed data and print it out
    print(f"My Sealed Data was: {unsealed.decode()}")

    print("Updating PCR 16")
    f.pcr_extend(16, b"\x42" * 100)
    print("PCR 16 Updated")
    
    print("Attempting to unseal data tethered to PCR 16 state")
    #try:
    f.unseal("/SRK/my_seal")
    #except TSS2_Exception:
    #    print("Unseal failed as expected")

    print("Deleting Sealed Data")

    f.delete("/SRK/my_seal")

    print("Sealed data deleted")

Image

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Fields

    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions