SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

tpm2-util: fix PCR bank guessing without EFI

Browse Source 
Since 7643e4a89 efi_get_active_pcr_banks() is used to determine the
active PCR banks. Without EFI support, this returns -EOPNOTSUPP. This in
turns leads to cryptenroll and cryptsetup attach failures unless the PCR
bank is explicitly set, i.e.

$ systemd-cryptenroll $LUKS_PART --tpm2-device=auto --tpm2-pcrs='7'
[...]
Could not read pcr values: Operation not supported

But it works fine with --tpm2-pcrs='7:sha256'.

Similarly, unsealing during cryptsetup attach also fails if the bank
needs to be determined:

Failed to unseal secret using TPM2: Operation not supported

Catch the -EOPNOTSUPP and fallback to the guessing strategy.

Signed-off-by: Patrick Wicki <patrick.wicki@subset.ch>
This commit is contained in:
Patrick Wicki
2026-03-25 23:18:58 +01:00
committed by Lennart Poettering
parent 91af485544
commit 6c7e5b81ac
1 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/shared/tpm2-util.c
+4 -4
View File
@@ -2892,11 +2892,11 @@ int tpm2_get_best_pcr_bank(
uint32_t efi_banks;
r = efi_get_active_pcr_banks(&efi_banks);
if (r < 0) {
if (r != -ENOENT)
if (!IN_SET(r, -ENOENT, -EOPNOTSUPP))
return r;
/* If variable is not set use guesswork below */
log_debug("Boot loader didn't set the LoaderTpm2ActivePcrBanks EFI variable, we have to guess the used PCR banks.");
log_debug("Boot loader didn't set the LoaderTpm2ActivePcrBanks EFI variable or EFI support is unavailable, we have to guess the used PCR banks.");
} else if (efi_banks == UINT32_MAX)
log_debug("Boot loader set the LoaderTpm2ActivePcrBanks EFI variable to indicate that the GetActivePcrBanks() API is not available in the firmware. We have to guess the used PCR banks.");
else {
@@ -3001,11 +3001,11 @@ int tpm2_get_good_pcr_banks(
uint32_t efi_banks;
r = efi_get_active_pcr_banks(&efi_banks);
if (r < 0) {
if (r != -ENOENT)
if (!IN_SET(r, -ENOENT, -EOPNOTSUPP))
return r;
/* If the variable is not set we have to guess via the code below */
log_debug("Boot loader didn't set the LoaderTpm2ActivePcrBanks EFI variable, we have to guess the used PCR banks.");
log_debug("Boot loader didn't set the LoaderTpm2ActivePcrBanks EFI variable or EFI support is unavailable, we have to guess the used PCR banks.");
} else if (efi_banks == UINT32_MAX)
log_debug("Boot loader set the LoaderTpm2ActivePcrBanks EFI variable to indicate that the GetActivePcrBanks() API is not available in the firmware. We have to guess the used PCR banks.");
else {