1 Commits

Include renames

Author	SHA1	Message	Date
jaap-jan	c2c860b4f2	Give the seated user the TPM, so nobody has to join the tss group ... ADR 0007 decision 4 refused this a commit ago, on the grounds that widening access to the machine's TPM is a system-wide decision an application package should not make for an administrator. That refusal is overturned here, and the reasoning it is replaced with is narrower rather than louder — because the refusal had treated "widen access" as one thing when it is two. Adding a person to `tss` is what the refusal was really about, and it stays the wrong answer: permanent, effective over SSH, applying whether or not they are at the keyboard, and needing an administrator and a fresh login before the feature appears at all. Tagging /dev/tpmrm0 with `uaccess` is a different thing. It is systemd's own mechanism for this exact question — the one /dev/dri, webcams, scanners and FIDO keys already use — and logind grants the ACL to the user of the *active local session*, then takes it back when that session ends. Not over SSH, not on an inactive VT, not to daemons. The rule changes neither the mode nor the group, so everything that worked before still works and the ACL is layered on top. tpmrm and never tpm, which is what makes it defensible at all: /dev/tpm0 is the raw device and is exclusive, where /dev/tpmrm0 is the kernel's resource manager, which virtualises handles and isolates callers precisely so that more than one unprivileged program can use the chip. ◆ THE COST IS A DENIAL OF SERVICE AND NOT A DISCLOSURE, AND IT IS WRITTEN DOWN. TPM objects are protected by their own auth values, so this lets nobody read anybody else's sealed data. What it allows is *failed* attempts — and a TPM answers enough of those by locking out everyone, which is the same anti-hammering this project relies on to make a four-digit PIN safe. On a machine that unlocks its disk with the TPM at boot, somebody sitting at it can trip that and stop the next boot from unlocking until it recovers. An administrator who does not accept that masks the file: sudo ln -s /dev/null /etc/udev/rules.d/71-dodossh-tpm.rules which is the standard override, survives upgrades, and puts DodoSSH back to behaving as though the machine had no TPM. That is in the rule's own comments, because the person who needs it is reading the file rather than the ADR. Numbered 71 because 60-tpm-udev.rules is what creates the node's ownership and 73-seat-late.rules is what turns the tag into an ACL; verified in that order on Fedora 44, along with `udevadm verify` accepting the file and the mask being reported as "masked by previous entry". %post reloads and replays it against the tpmrm subsystem, because a rule that waits for a reboot is a feature that does not work on the day it is installed. Both channels install the same path deliberately: this is about the machine's TPM rather than about either build, the file is byte-identical from both, and giving each its own copy would mean removing one package silently revoked the other's access. Phase 19 grew a check that the ACL exists for the local session and does *not* exist for an SSH one, and another that masking the rule really does put the machine back — then tells you to undo it before the checks that follow. Also recorded, after it cost five confusing failures: swtpm serves exactly one client, so a shell readiness probe sitting on the port makes the whole device-key suite fail with "The TPM closed the connection" and nothing pointing at why.	2026-08-22 20:38:22 +02:00