Add TPM2-PKCS11 support for X1 Carbon

This patch adds the initial support for PKCS#11 interface on the host
system for the X1 carbon, utilising the hardware TPM2.

Signed-off-by: Humaid Alqasimi <[email protected]>

modules/module-list.nix

@@ -17,6 +17,7 @@
   ./profiles/graphics.nix
   ./profiles/installer.nix
   ./profiles/release.nix
+  ./security/tpm2.nix
   ./users/accounts.nix
   ./version
   ./virtualization/docker.nix

modules/security/tpm2.nix

@@ -0,0 +1,35 @@
+# Copyright 2024 TII (SSRC) and the Ghaf contributors
+# SPDX-License-Identifier: Apache-2.0
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}: let
+  cfg = config.ghaf.security.tpm2;
+in
+  with lib; {
+    options.ghaf.security.tpm2 = {
+      enable = mkEnableOption "TPM2 PKCS#11 interface";
+    };
+
+    config = mkIf cfg.enable {
+      security.tpm2 = {
+        enable = true;
+        pkcs11.enable = true;
+        abrmd.enable = true;
+      };
+
+      environment.systemPackages = mkIf config.ghaf.profiles.debug.enable [
+        pkgs.opensc
+        pkgs.tpm2-tools
+      ];
+
+      assertions = [
+        {
+          assertion = pkgs.stdenv.isx86_64;
+          message = "TPM2 is only supported on x86_64";
+        }
+      ];
+    };
+  }

modules/users/accounts.nix

@@ -37,7 +37,10 @@ in
           isNormalUser = true;
           inherit (cfg) password;
           #TODO add "docker" use "lib.optionals"
-          extraGroups = ["wheel" "video" "networkmanager"];
+          extraGroups =
+            ["wheel" "video" "networkmanager"]
+            ++ optionals
+            config.ghaf.security.tpm2.enable ["tss"];
         };
         groups."${cfg.user}" = {
           name = cfg.user;

overlays/custom-packages/default.nix

@@ -13,5 +13,6 @@ _: {
     (import ./qemu)
     (import ./nm-launcher)
     (import ./labwc)
+    (import ./tpm2-pkcs11)
   ];
 }

overlays/custom-packages/tpm2-pkcs11/default.nix

@@ -0,0 +1,10 @@
+# Copyright 2024 TII (SSRC) and the Ghaf contributors
+# SPDX-License-Identifier: Apache-2.0
+#
+# This overlay customizes tpm2-pkcs11 - see comments for details
+#
+(_final: prev: {
+  tpm2-pkcs11 = prev.tpm2-pkcs11.overrideAttrs (_prevAttrs: {
+    configureFlags = ["--with-fapi=no --enable-fapi=no"];
+  });
+})

targets/lenovo-x1-carbon.nix

@@ -327,6 +327,8 @@
 
               hardware.x86_64.common.enable = true;
 
+              security.tpm2.enable = true;
+
               virtualization.microvm-host.enable = true;
               host.networking.enable = true;
               virtualization.microvm.netvm = {