Original Summary

A kernel guard I prototyped after eBPF and vTPM work for a customer, where we use the TPM to protect the private keys for mTLS. Any process running as root can open the TPM devices, and so can any process in the tss group, through /dev/tpmrm0. That means they can use those keys too. This is a prototype and some research into protecting this path.

  • 情报分类：综合情报
  • 分类依据：内容未命中明确的垂直分类规则，归入综合情报
  • 信息来源：Hacker News 新项目
  • 发布时间：2026/10/5 05:34:52