From 5f85409f932dfdc123d0e8ded8e8a9a6f9443119 Mon Sep 17 00:00:00 2001
From: Lennart Poettering <lennart@amutable.com>
Date: Tue, 3 Mar 2026 14:27:36 +0100
Subject: [PATCH] tpm2-util: also load libtss2-tcti-device.so.0 in
 dlopen_tpm2()

This TCTI module is the one we need to actually access a Linux TPM
device, we'll hence pretty much always need it if we do TPM at all.
Given that we nowadays turn off dlopen() after fork() in the child,
let's explicitly load it as part of dlopen_tpm2() so that it is
available whenever TPM2 is used.
---
 src/basic/dlfcn-util.c | 20 +++++++++++++++++++-
 src/basic/dlfcn-util.h |  1 +
 src/shared/tpm2-util.c | 19 +++++++++++++++++++
 3 files changed, 39 insertions(+), 1 deletion(-)

diff --git a/src/basic/dlfcn-util.c b/src/basic/dlfcn-util.c
index 8574e99546..23bd1f666e 100644
--- a/src/basic/dlfcn-util.c
+++ b/src/basic/dlfcn-util.c
@@ -47,9 +47,11 @@ int dlsym_many_or_warn_sentinel(void *dl, int log_level, ...) {
         return r;
 }
 
-int dlopen_many_sym_or_warn_sentinel(void **dlp, const char *filename, int log_level, ...) {
+int dlopen_verbose(void **dlp, const char *filename) {
         int r;
 
+        assert(dlp);
+
         if (*dlp)
                 return 0; /* Already loaded */
 
@@ -62,6 +64,22 @@ int dlopen_many_sym_or_warn_sentinel(void **dlp, const char *filename, int log_l
         }
 
         log_debug("Loaded shared library '%s' via dlopen().", filename);
+        *dlp = TAKE_PTR(dl);
+        return 1;
+}
+
+int dlopen_many_sym_or_warn_sentinel(void **dlp, const char *filename, int log_level, ...) {
+        int r;
+
+        assert(dlp);
+
+        if (*dlp)
+                return 0; /* Already loaded */
+
+        _cleanup_(dlclosep) void *dl = NULL;
+        r = dlopen_verbose(&dl, filename);
+        if (r < 0)
+                return r;
 
         va_list ap;
         va_start(ap, log_level);
diff --git a/src/basic/dlfcn-util.h b/src/basic/dlfcn-util.h
index 367c47ddb8..9760b31da4 100644
--- a/src/basic/dlfcn-util.h
+++ b/src/basic/dlfcn-util.h
@@ -11,6 +11,7 @@ static inline void dlclosep(void **dlp) {
         safe_dlclose(*dlp);
 }
 
+int dlopen_verbose(void **dlp, const char *filename);
 int dlsym_many_or_warn_sentinel(void *dl, int log_level, ...) _sentinel_;
 int dlopen_many_sym_or_warn_sentinel(void **dlp, const char *filename, int log_level, ...) _sentinel_;
 
diff --git a/src/shared/tpm2-util.c b/src/shared/tpm2-util.c
index b0f6387b03..0d4f51dc1e 100644
--- a/src/shared/tpm2-util.c
+++ b/src/shared/tpm2-util.c
@@ -53,6 +53,7 @@
 static void *libtss2_esys_dl = NULL;
 static void *libtss2_rc_dl = NULL;
 static void *libtss2_mu_dl = NULL;
+static void *libtss2_tcti_device_dl = NULL;
 
 static DLSYM_PROTOTYPE(Esys_Create) = NULL;
 static DLSYM_PROTOTYPE(Esys_CreateLoaded) = NULL;
@@ -226,6 +227,20 @@ static int dlopen_tpm2_mu(void) {
                         DLSYM_ARG(Tss2_MU_UINT32_Marshal));
 }
 
+static int dlopen_tpm2_tcti_device(void) {
+        /* The "device" TCTI is the most relevant one, let's also load it explicitly on dlopen_tpm2(), even
+         * if we don't resolve any symbols here. */
+
+        ELF_NOTE_DLOPEN("tpm",
+                        "Support for TPM",
+                        ELF_NOTE_DLOPEN_PRIORITY_SUGGESTED,
+                        "libtss2-tcti-device.so.0");
+
+        return dlopen_verbose(
+                        &libtss2_tcti_device_dl,
+                        "libtss2-tcti-device.so.0");
+}
+
 #endif
 
 int dlopen_tpm2(void) {
@@ -244,6 +259,10 @@ int dlopen_tpm2(void) {
         if (r < 0)
                 return r;
 
+        r = dlopen_tpm2_tcti_device();
+        if (r < 0)
+                return r;
+
         return 0;
 #else
         return -EOPNOTSUPP;