Re: Disabling TPM in ChromiumOS

[Luigi Semenzato]

Hi Alexandre,

let me pass this on to Frank who should be able to help you better
than I can. I am also copying chromium-os-dev since this may be of
general interest.

Luigi

On Wed, Jan 12, 2011 at 4:19 PM, Alexandre Tisserant
<alex...@alwaysinnovating.com> wrote:
> Hi,
>
> I'm building ChromiumOS on ARM, but I have no TPM hardware on my device. Following redpig's advice from the chatroom, I'm trying to make a build with no tpm support so that it falls over libscrypt directly.
>
> I didn't find any obvious switch / flag in the build process so I tried to simply apply the following patch to mount.cc. TPM is indeed not started but I'm not sure it's enough to make things work. In particular, I still can't login (my credentials are said to be bad).
>
> Do you have any clue on how exactly disable TPM support and use libscrypt instead?
>
> Thanks in advance,
> Alexandre Tisserant
>
> --- a/mount.cc
> +++ b/mount.cc
> @@ -57,7 +57,7 @@ Mount::Mount()
>       default_platform_(new Platform()),
>       platform_(default_platform_.get()),
>       fallback_to_scrypt_(true),
> -      use_tpm_(true),
> +      use_tpm_(false),
>       default_current_user_(new UserSession()),
>       current_user_(default_current_user_.get()) {
>  }
> @@ -75,6 +75,7 @@ bool Mount::Init() {
>   }
>
>   crypto_->set_use_tpm(use_tpm_);
> +  crypto_->set_load_tpm(false);
>   crypto_->set_fallback_to_scrypt(fallback_to_scrypt_);
>
>   int original_mask = platform_->SetMask(kDefaultUmask);

[Alexandre Tisserant]

Hi,

OK. It looks like the owner key in /var/lib/whitelist/ can't be created; I also have a 'salt' file only in /home/.shadow while I understand there should be a user-name-hashed directory created. Any hint on what I'm missing to enable libscrypt instead of TPM?

Thanks
Alexandre Tisserant

[Chris Masone]

On Thu, Jan 13, 2011 at 9:09 AM, Alexandre Tisserant <alex...@alwaysinnovating.com> wrote:

Hi,

OK. It looks like the owner key in /var/lib/whitelist/ can't be created;

that's not created until a successful login has occurred anyway.

 

I also have a 'salt' file only in /home/.shadow while I understand there should be a user-name-hashed directory created. Any hint on what I'm missing to enable libscrypt instead of TPM?

That's also a product of successful login...you may have fixated on this TPM problem, when really it's something else that's preventing a login from completing that's causing your issues.  Have you looked at the logs in /var/log/ui and /var/log/chrome and /var/log/session_manager?

 

Thanks
Alexandre Tisserant

--
Chromium OS Developers mailing list: chromiu...@chromium.org
View archives, change email options, or unsubscribe:
http://groups.google.com/a/chromium.org/group/chromium-os-dev?hl=en

[Luigi Semenzato]

In fact, I thought that we automatically switched to software
encryption when the TPM is not available.

[Alexandre TISSERANT]

OK so my problem should be elsewhere. Now booting with a vanilla cryptohome/tpm install, I get these logs:
* chrome/chrome
<before attempting to log in>
[490:536:19450531:ERROR:

plugin_selection_policy.cc(60)] Unable to read plugin policy file "/usr/share/chromeos-assets/flash/plugin_policy".
[490:490:20531188:WARNING:proxy_config_service_impl.cc(516)] Error retrieving proxy setting from device
[490:490:22413665:ERROR:apply_services_customization.cc(86)] Failed to load services customization manifest from: /mnt/partner_partition/etc/chromeos/services_manifest.
json
[490:540:27084472:ERROR:nss_util.cc(234)] Error initializing NSS with a persistent database (sql:/etc/fake_root_ca/nssdb): NSS error code -8174
[490:540:27085083:WARNING:nss_util.cc(240)] Initialize NSS without a persistent database (~/.pki/nssdb).
[490:541:27331115:ERROR:x509_certificate_nss.cc(763)] CERT_PKIXVerifyCert for www.google.com failed err=-8181
[490:1971:54512084:ERROR:x509_certificate_nss.cc(763)] CERT_PKIXVerifyCert for www.google.com failed err=-8181
<after attempting to log in>
[490:490:81504852:WARNING:ownership_service.cc(36)] Device not yet owned
[490:540:81817657:ERROR:online_attempt.cc(90)] Login attempt canceled!?!?  Trying again.
[490:540:81932403:ERROR:online_attempt.cc(94)] Login attempt canceled again?  Already retried...
[490:490:81933410:WARNING:parallel_authenticator.cc(213)] Login failed: Google authentication failed.
[490:490:84048828:WARNING:ownership_service.cc(36)] Device not yet owned
[490:540:84285400:ERROR:online_attempt.cc(90)] Login attempt canceled!?!?  Trying again.
[490:540:84372314:ERROR:online_attempt.cc(94)] Login attempt canceled again?  Already retried...
[490:490:84373565:WARNING:parallel_authenticator.cc(213)] Login failed: Google authentication failed.
[490:490:93629119:WARNING:ownership_service.cc(36)] Device not yet owned
[490:540:93956176:ERROR:online_attempt.cc(90)] Login attempt canceled!?!?  Trying again.
[490:540:94049713:ERROR:online_attempt.cc(94)] Login attempt canceled again?  Already retried...
[490:490:94055847:WARNING:parallel_authenticator.cc(213)] Login failed: Google authentication failed.
[490:1971:110752868:ERROR:x509_certificate_nss.cc(763)] CERT_PKIXVerifyCert for sb-ssl.google.com failed err=-8181
[490:490:144643310:ERROR:cryptohome_library.cc(155)] Received signal for unknown async_id 4

* session_manager
[1231/160013:INFO:session_manager_service.cc(295)] Running child window-manager-session.sh...
[1231/160013:INFO:owner_key.cc(42)] No owner key on disk.
[1231/160017:INFO:session_manager_service.cc(1008)] The requested property cros.proxy.everywhere is unknown.
[1231/160017:ERROR:session_manager_service.cc(785)] The requested property cros.proxy.everywhere is unknown.
[1231/160019:INFO:upstart_signal_emitter.cc(20)] Emitting login-prompt-ready Upstart signal
[1231/160019:INFO:session_manager_service.cc(1008)] The requested property cros.accounts.allowGuest is unknown.
[1231/160019:ERROR:session_manager_service.cc(785)] The requested property cros.accounts.allowGuest is unknown.
[1231/160019:INFO:session_manager_service.cc(1008)] The requested property cros.accounts.allowBWSI is unknown.
[1231/160019:ERROR:session_manager_service.cc(785)] The requested property cros.accounts.allowBWSI is unknown.
[1231/160019:INFO:session_manager_service.cc(1008)] The requested property cros.accounts.showUserNamesOnSignIn is unknown.
[1231/160019:ERROR:session_manager_service.cc(785)] The requested property cros.accounts.showUserNamesOnSignIn is unknown.
[1231/160019:INFO:session_manager_service.cc(1008)] The requested property cros.device.owner is unknown.
[1231/160019:ERROR:session_manager_service.cc(785)] The requested property cros.device.owner is unknown.
[1231/160020:INFO:upstart_signal_emitter.cc(20)] Emitting login-prompt-visible Upstart signal

* ui/ui.LATEST
<before attempting to log in>
[...]
[1231/160019:INFO:chromeos_keyboard.cc(112)] Current XKB layout name: us
[1231/160019:INFO:chromeos_keyboard.cc(289)] XKB layout is changed to us+chromeos(search_leftcontrol_leftalt)+version(v1_7_r15)
[1231/160019:INFO:chromeos_keyboard.cc(181)] Set auto-repeat mode to: on
[1231/160019:INFO:chromeos_keyboard.cc(212)] Set auto-repeat rate to: 500 ms delay, 50 ms interval
[1231/160019:WARNING:chromeos_power.cc(126)] Battery is missing!
[1231/160019:INFO:chromeos_login.cc(417)] Ownership API status monitoring started
[1231/160019:INFO:session_manager_service.cc(1008)] The requested property cros.proxy.everywhere is unknown.
[1231/160019:ERROR:session_manager_service.cc(785)] The requested property cros.proxy.everywhere is unknown.
[1231/160019:WARNING:chromeos_login_helpers.cc(103)] RetrieveProperty failed: Login error: The requested property cros.proxy.everywhere is unknown.

(chrome:490): Pango-WARNING **: Error loading GPOS table 0x6EAD
cat: /tmp/machine-info: No such file or directory
[1231/160020:INFO:chromeos_input_method.cc(1235)] xkb:us::eng (preload later)
[1231/160020:INFO:chromeos_input_method.cc(1235)] xkb:us:intl:eng (preload later)
[1231/160020:INFO:chromeos_input_method.cc(1235)] xkb:us:altgr-intl:eng (preload later)
[1231/160020:INFO:chromeos_input_method.cc(1235)] xkb:us:dvorak:eng (preload later)
[1231/160020:INFO:chromeos_input_method.cc(1235)] xkb:us:colemak:eng (preload later)
[1231/160021:INFO:upstart_signal_emitter.cc(20)] Emitting login-prompt-ready Upstart signal
[490:490:22413665:ERROR:apply_services_customization.cc(86)] Failed to load services customization manifest from: /mnt/partner_partition/etc/chromeos/services_manifest.
json
[1231/160021:INFO:session_manager_service.cc(1008)] The requested property cros.accounts.allowGuest is unknown.
[1231/160021:ERROR:session_manager_service.cc(785)] The requested property cros.accounts.allowGuest is unknown.
[1231/160021:WARNING:chromeos_login_helpers.cc(103)] RetrieveProperty failed: Login error: The requested property cros.accounts.allowGuest is unknown.
[1231/160022:INFO:session_manager_service.cc(1008)] The requested property cros.accounts.allowBWSI is unknown.
[1231/160022:ERROR:session_manager_service.cc(785)] The requested property cros.accounts.allowBWSI is unknown.
[1231/160022:WARNING:chromeos_login_helpers.cc(103)] RetrieveProperty failed: Login error: The requested property cros.accounts.allowBWSI is unknown.
[1231/160022:INFO:session_manager_service.cc(1008)] The requested property cros.accounts.showUserNamesOnSignIn is unknown.
[1231/160022:ERROR:session_manager_service.cc(785)] The requested property cros.accounts.showUserNamesOnSignIn is unknown.
[1231/160022:WARNING:chromeos_login_helpers.cc(103)] RetrieveProperty failed: Login error: The requested property cros.accounts.showUserNamesOnSignIn is unknown.
[1231/160022:INFO:session_manager_service.cc(1008)] The requested property cros.device.owner is unknown.
[1231/160022:ERROR:session_manager_service.cc(785)] The requested property cros.device.owner is unknown.
[1231/160022:WARNING:chromeos_login_helpers.cc(103)] RetrieveProperty failed: Login error: The requested property cros.device.owner is unknown.
[1231/160023:INFO:upstart_signal_emitter.cc(20)] Emitting login-prompt-visible Upstart signal
[490:540:27084472:ERROR:nss_util.cc(234)] Error initializing NSS with a persistent database (sql:/etc/fake_root_ca/nssdb): NSS error code -8174
[490:541:27331115:ERROR:x509_certificate_nss.cc(763)] CERT_PKIXVerifyCert for www.google.com failed err=-8181
[490:1971:54512084:ERROR:x509_certificate_nss.cc(763)] CERT_PKIXVerifyCert for www.google.com failed err=-8181
<after attempting to log in>
[1231/160120:INFO:chromeos_cryptohome.cc(792)] Cryptohome API event monitoring started
[1231/160120:INFO:chromeos_cryptohome.cc(756)] Filter:: AsyncCallStatus signal received
[490:540:81817657:ERROR:online_attempt.cc(90)] Login attempt canceled!?!?  Trying again.
[490:540:81932403:ERROR:online_attempt.cc(94)] Login attempt canceled again?  Already retried...
[1231/160123:INFO:chromeos_cryptohome.cc(756)] Filter:: AsyncCallStatus signal received
[490:540:84285400:ERROR:online_attempt.cc(90)] Login attempt canceled!?!?  Trying again.
[490:540:84372314:ERROR:online_attempt.cc(94)] Login attempt canceled again?  Already retried...
[1231/160133:INFO:chromeos_cryptohome.cc(756)] Filter:: AsyncCallStatus signal received
[490:540:93956176:ERROR:online_attempt.cc(90)] Login attempt canceled!?!?  Trying again.
[490:540:94049713:ERROR:online_attempt.cc(94)] Login attempt canceled again?  Already retried...
[490:1971:110752868:ERROR:x509_certificate_nss.cc(763)] CERT_PKIXVerifyCert for sb-ssl.google.com failed err=-8181
[1231/160223:INFO:chromeos_cryptohome.cc(756)] Filter:: AsyncCallStatus signal received
[490:490:144643310:ERROR:cryptohome_library.cc(155)] Received signal for unknown async_id 4

So these errors are not linked at all with a cryptohome / tpm issue?

Alexandre

2011/1/13 Luigi Semenzato <seme...@chromium.org>

[Chris Masone]

On Thu, Jan 13, 2011 at 11:29 AM, Alexandre TISSERANT <alex...@alwaysinnovating.com> wrote:

[490:541:27331115:ERROR:x509_certificate_nss.cc(763)] CERT_PKIXVerifyCert for www.google.com failed err=-8181

That is your problem.  Your machine thinks that google.com's SSL cert has expired, so we won't log you in.

Clock issues, most likely.  What date/time does your machine think it is?

[Alexandre TISSERANT]

Good point, my system was in 1999... But once the date fixed, I still get a "could not mount cryptohome" error:

* chrome/chrome
[317:362:18923522:ERROR:

plugin_selection_policy.cc(60)] Unable to read plugin policy file "/usr/share/chromeos-assets/flash/plugin_policy".

[317:317:20335327:WARNING:proxy_config_service_impl.cc(516)] Error retrieving proxy setting from device
[317:317:22512969:ERROR:apply_services_customization.cc(86)] Failed to load services customization manifest from: /mnt/partner_partition/etc/chromeos/services_manifest.
json
[317:366:27194274:ERROR:nss_util.cc(234)] Error initializing NSS with a persistent database (sql:/etc/fake_root_ca/nssdb): NSS error code -8174
[317:366:27201904:WARNING:nss_util.cc(240)] Initialize NSS without a persistent database (~/.pki/nssdb).
[317:317:131442626:WARNING:ownership_service.cc(36)] Device not yet owned
[317:317:132971008:WARNING:parallel_authenticator.cc(213)] Login failed: Could not mount cryptohome.
[317:317:133425292:WARNING:ownership_service.cc(36)] Device not yet owned
[317:366:133876373:WARNING:gaia_auth_fetcher.cc(337)] ClientLogin failed with BadAuthentication
[317:317:134022705:WARNING:parallel_authenticator.cc(213)] Login failed: Google authentication failed.
[317:317:144398956:ERROR:cryptohome_library.cc(155)] Received signal for unknown async_id 3

I am using a custom kernel for my device; I saw some tpm code modified in yours, but as I don't use it, it should not be a problem, right?

Alexandre

2011/1/13 Chris Masone <cma...@chromium.org>

[Chris Masone]

On Thu, Jan 13, 2011 at 12:57 PM, Alexandre TISSERANT <alex...@alwaysinnovating.com> wrote:

[317:366:133876373:WARNING:gaia_auth_fetcher.cc(337)] ClientLogin failed with BadAuthentication
[317:317:134022705:WARNING:parallel_authenticator.cc(213)] Login failed: Google authentication failed.

It can't mount your cryptohome because you don't have one yet.  You won't have one until you successfully authenticate to Google.  The above error message indicates that you can't successfully authenticate to Google for some reason.

Modify the command line options we send to chrome in /sbin/session_manager_setup.sh to include --v=1 to get much more verbose logging output.  That may help.

[Alexandre Tisserant]

OK so I actually just forgot to compile ecryptfs in my custom kernel. Works better now!

Thanks all for your fast help. That's really useful.

[Luigi Semenzato]

Thank you for working on Chrome OS!