Requesting review of a PAM based on TPM NV storage

Prashant Kumar <[email protected]> Mon, 24 Feb 2025 18:55:07 +0000
Newsgroups dev.linux.lists.tpm2
Message-ID <_zjU5bKR6fy_fg-jmo5qPfwtwOk8THOadSQMV2b-YrjN0e-jVSJPQuit2BjzmVQLT9XbSwn0P5MjuF9q9d5Xthh0YjoCgiSor0l3RXi4Vn8=@protonmail.com>
Hello!

I posted the same message in Gitter, but I think it mostly stays inactive s=
o posting it here as well.

As a fun little side-project, I have created a PAM that uses TPM's NV stora=
ge for PIN based authentication. It uses the authValue of Fapi_CreateNV() t=
o set the PIN and Fapi_NvRead() is used by PAM for verifying the PIN, if th=
e read operation is successful, the auth is approved. The implementation of=
 PAM is barebones and skips over many obvious checks. This is just a PoC to=
 check if using NV storage in the way I'm using is safe or not. So, I'd app=
reciate if good people of this community can review the code and tell me if=
 my novice attempt at this missed any obvious flaw.

Link to project: https://github.com/notsoshant/libpam-tpm

notsoshant