SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

creds: add io.systemd.Credentials.PCRsKeptChanging error

Browse Source 
io.systemd.Credentials.UnexpectedPCRState used to be mapped to EUCLEAN,
which now means "a PCR kept being extended while unsealing" rather than
"the PCR state does not match the policy".  Map it to EPERM instead,
which is one of the errnos ERRNO_IS_NEG_TPM2_UNSEAL_BAD_PCR() covers,
and introduce a separate PCRsKeptChanging error for EUCLEAN.

Also report the condition explicitly in decrypt_credential_and_warn(),
like the other TPM2 unseal callers do.

Signed-off-by: Alberto Planas <aplanas@suse.com>
(cherry picked from commit 42f3ac664a)
This commit is contained in:
Alberto Planas
2026-10-16 11:36:32 +01:00
committed by Luca Boccassi
parent 1e3fa26b7c
commit a30858ebc3
2 changed files with 7 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/shared/creds-util.c
+4 -1
View File
@@ -1534,6 +1534,8 @@ int decrypt_credential_and_warn(
return log_error_errno(r, "TPM key integrity check failed. Key most likely does not belong to this TPM.");
if (r == -EADDRNOTAVAIL)
return log_error_errno(r, "NV index referenced by key is missing, unwritten, or unusable, it could be for another system.");
if (r == -EUCLEAN)
return log_error_errno(r, "PCR values kept changing while unsealing the TPM2 secret, giving up. Something on this system extends a PCR continuously.");
if (ERRNO_IS_NEG_TPM2_UNSEAL_BAD_PCR(r))
return log_error_errno(r, "TPM policy does not match current system state. Either system has been tampered with or policy out-of-date: %m");
if (r < 0)
@@ -1985,7 +1987,8 @@ static const CredentialsVarlinkError credentials_varlink_error_table[] = {
{ "io.systemd.Credentials.NullKeyNotAllowed", EHWPOISON, "The key was encrypted with a null key, but that's not allowed during decryption." },
{ "io.systemd.Credentials.KeyBelongsToOtherTPM", EREMOTE, "The TPM integrity check for this key failed, key probably belongs to another TPM, or was corrupted." },
{ "io.systemd.Credentials.TPMInDictionaryLockout", ENOLCK, "The TPM is in dictionary lockout mode, cannot operate." },
{ "io.systemd.Credentials.UnexpectedPCRState" , EUCLEAN, "Unexpected TPM PCR state of the system." },
{ "io.systemd.Credentials.UnexpectedPCRState", EPERM, "Unexpected TPM PCR state of the system." },
{ "io.systemd.Credentials.PCRsKeptChanging", EUCLEAN, "PCR values kept changing while unsealing the TPM2 secret, something on this system extends a PCR continuously." },
{ "io.systemd.Credentials.NVIndexUnusable", EADDRNOTAVAIL, "The NV index referenced by the key is missing, unwritten, or unusable, it could be for another system." },
};
src/shared/varlink-io.systemd.Credentials.c
+3
View File
@@ -79,6 +79,7 @@ static SD_VARLINK_DEFINE_ERROR(NullKeyNotAllowed);
static SD_VARLINK_DEFINE_ERROR(KeyBelongsToOtherTPM);
static SD_VARLINK_DEFINE_ERROR(TPMInDictionaryLockout);
static SD_VARLINK_DEFINE_ERROR(UnexpectedPCRState);
static SD_VARLINK_DEFINE_ERROR(PCRsKeptChanging);
static SD_VARLINK_DEFINE_ERROR(NVIndexUnusable);
SD_VARLINK_DEFINE_INTERFACE(
@@ -113,5 +114,7 @@ SD_VARLINK_DEFINE_INTERFACE(
&vl_error_TPMInDictionaryLockout,
SD_VARLINK_SYMBOL_COMMENT("Unexpected TPM PCR state of the system."),
&vl_error_UnexpectedPCRState,
SD_VARLINK_SYMBOL_COMMENT("PCR values kept changing while unsealing the TPM2 secret, something on this system extends a PCR continuously."),
&vl_error_PCRsKeptChanging,
SD_VARLINK_SYMBOL_COMMENT("The NV index referenced by the key is missing, unwritten, or unusable, it could be for another system."),
&vl_error_NVIndexUnusable);