cryptsetup: Skip tokens with JSON parsing errors

The plugin already continues on parsing errors but the fallback path
not. The plugin swallows ENOMEM as well which is too much, though.
Continue on JSON parsing errors by mapping them to EUCLEAN in
cryptsetup_get_token_as_json and handle that in any call site, not just
the TPM fallback path but also others.
This commit is contained in:
Kai Lüke
2026-07-10 08:07:47 +02:00
committed by Kai Lüke
parent 14c0b8414f
commit 7fb6b9c2a2
8 changed files with 12 additions and 6 deletions
+1 -1
View File
@@ -110,7 +110,7 @@ int find_pkcs11_auto_data(
int ks;
r = cryptsetup_get_token_as_json(cd, token, "systemd-pkcs11", &v);
if (IN_SET(r, -ENOENT, -EINVAL, -EMEDIUMTYPE))
if (ERRNO_IS_NEG_CRYPTSETUP_TOKEN_SKIP(r))
continue;
if (r < 0)
return log_error_errno(r, "Failed to read JSON token data off disk: %m");
@@ -87,6 +87,8 @@ _public_ int cryptsetup_token_open_pin(
params = *(systemd_tpm2_plugin_params *)usrptr;
r = sd_json_parse(json, SD_JSON_PARSE_MUST_BE_OBJECT, &v, /* reterr_line= */ NULL, /* reterr_column= */ NULL);
if (r == -ENOMEM)
return r;
if (r < 0) {
/* Remap to -EPERM so libcryptsetup keeps iterating past a broken token. */
(void) crypt_log_debug_errno(cd, r, "Token %d: failed to parse JSON data: %m", token);