cryptenroll: do not pass an empty pcrlock policy

Otherwise, tpm2_uneal() -> tpm2_build_sealing_policy() -> tpm2_deserialize() will trigger assertion. Prompted by #33017.
2024-05-26 04:42:19 +09:00
parent caebda361e
commit 16f51e2909
1 changed files with 2 additions and 0 deletions
@@ -342,6 +342,8 @@ int enroll_tpm2(struct crypt_device *cd,
                r = tpm2_pcrlock_policy_load(pcrlock_path, &pcrlock_policy);
                if (r < 0)
                        return r;
+                if (r == 0)
+                        return log_error_errno(SYNTHETIC_ERRNO(ENOENT), "Couldn't find pcrlock policy %s.", pcrlock_path);

                any_pcr_value_specified = true;
                flags |= TPM2_FLAGS_USE_PCRLOCK;