azure: TCTI is hardcoded to the raw /dev/tpm0 device

Open
#72 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
48/100
Issue type
Feature
Clarity
Mostly clear
Activity status
Quiet
Tech stack
rust
Domain
security

Research direction

Start in crates/attestation/src/azure/nv_index.rs at the hardcoded TctiNameConf::Device(DeviceConfig::default()) call, then trace the Azure evidence path through az_tdx_vtpm::vtpm and az-cvm-vtpm src/vtpm/mod.rs. Review the linked azure-cvm-tooling issue for the upstream change. Done means the conventional TCTI environment variable is honored while the existing device default remains the fallback across the Azure path.

Written by the indexing model from the issue text.

Description

crates/attestation/src/azure/nv_index.rs builds its TSS context with the
hardcoded default TCTI:

let conf: TctiNameConf = TctiNameConf::Device(DeviceConfig::default());

DeviceConfig::default() is the raw /dev/tpm0 device, which the kernel
hands to one client at a time: any other TPM user on the machine
(tpm2-tools, systemd, a second evidence-generating process) makes context
creation fail with a device-busy error, and vice versa. The kernel's TPM
resource manager (/dev/tpmrm0) multiplexes clients, but there is
currently no way to select it.

Proposal: resolve the TCTI via TctiNameConf::from_environment_variable()
(which honors the conventional TPM2TOOLS_TCTI / TCTI variables, e.g.
device:/dev/tpmrm0) and keep the current default as fallback — no
behavior change unless the variable is set.

Note the azure evidence path also reaches the same hardcoded pattern
upstream through az_tdx_vtpm::vtpm (az-cvm-vtpm src/vtpm/mod.rs), so
fully honoring the variable needs the matching upstream change too — filed
as https://github.com/kinvolk/azure-cvm-tooling/issues/92.

Dominant language
Rust
Stars
6
Forks
3
Avg merge
4d 5h
Merged PRs (30d)
7

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from flashbots/attested-tls

All issues in flashbots/attested-tls

Similar issues

More Rust issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.