SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

tpm2-util: initialize NvPCRs on first extension

Browse Source 
Both callers of tpm2_nvpcr_extend_bytes() duplicate the same dance: on
-ENETDOWN, i.e. when the NvPCR isn't anchored yet because
systemd-tpm2-setup hasn't run, they acquire the anchor secret,
initialize the NvPCR, and extend again. Move this into
tpm2_nvpcr_extend_bytes() itself. The only caller-specific bit, whether
the anchor secret shall be synced to /var, is passed in as a parameter.

Signed-off-by: Paul Meyer <katexochen0@gmail.com>
This commit is contained in:
Paul Meyer
2026-07-15 13:25:37 +02:00
parent 5a12005c83
commit dcf86d1529
4 changed files with 53 additions and 33 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/cryptsetup/cryptsetup.c
+9 -14
View File
@@ -1138,20 +1138,15 @@ static int measure_keyslot(
if (!s)
return log_oom();
r = tpm2_nvpcr_extend_bytes(c, /* session= */ NULL, arg_tpm2_measure_keyslot_nvpcr, &IOVEC_MAKE_STRING(s), /* secret= */ NULL, TPM2_EVENT_KEYSLOT, s);
if (r == -ENETDOWN) {
/* NvPCR is not initialized yet. Do so now. */
_cleanup_(iovec_done_erase) struct iovec anchor_secret = {};
r = tpm2_nvpcr_acquire_anchor_secret(&anchor_secret, /* sync_secondary= */ false);
if (r < 0)
return r;
r = tpm2_nvpcr_initialize(c, /* session= */ NULL, arg_tpm2_measure_keyslot_nvpcr, &anchor_secret);
if (r < 0)
return log_error_errno(r, "Failed to extend NvPCR index '%s' with anchor secret: %m", name);
r = tpm2_nvpcr_extend_bytes(c, /* session= */ NULL, arg_tpm2_measure_keyslot_nvpcr, &IOVEC_MAKE_STRING(s), /* secret= */ NULL, TPM2_EVENT_KEYSLOT, s);
}
r = tpm2_nvpcr_extend_bytes(
c,
/* session= */ NULL,
arg_tpm2_measure_keyslot_nvpcr,
&IOVEC_MAKE_STRING(s),
/* secret= */ NULL,
/* sync_secondary_anchor= */ false,
TPM2_EVENT_KEYSLOT,
s);
if (r < 0)
return log_error_errno(r, "Could not extend NvPCR: %m");