tpm2-util: For NV index errors report EREMOTE to be able to continue

When we have many LUKS slots and not all are for our TPM, we can get an
NV index error when it's missing or has wrong content.
Instead of fully erroring out, map these encounters to EREMOTE like we
do for a foreign TPM key.
This commit is contained in:
Kai Lüke
2026-07-10 08:07:47 +02:00
committed by Kai Lüke
parent 93bc6a3415
commit ac5f02cc76
3 changed files with 8 additions and 4 deletions
@@ -112,7 +112,7 @@ int acquire_luks2_key(
srk,
ret_decrypted_key);
if (r == -EREMOTE)
return log_error_errno(r, "TPM key integrity check failed. Key enrolled in superblock most likely does not belong to this TPM.");
return log_error_errno(r, "TPM key integrity check failed or NV index unusable. Key enrolled in superblock most likely does not belong to this TPM.");
if (r == -EILSEQ)
return log_error_errno(SYNTHETIC_ERRNO(ENOANO), "Bad PIN."); /* cryptsetup docs say we should return ENOANO on bad PIN */
if (r == -ENOLCK)