shaba/systemd-stable
1
1
Fork 0
mirror of https://github.com/systemd/systemd-stable.git synced 2025-01-05 09:17:44 +03:00
Code

creds-util: do not try TPM2 if there is not support

Browse Source 
During the credentials encryption, if systemd it is compiled with TPM2
support, it will try to use it depending on the key flags passed.

The current code only checks if the system has a functional TPM2 if the
case of the INITRD flag.

This patch do a similar check in the case that it is outside initrd (but
still automatic).

Signed-off-by: Alberto Planas <aplanas@suse.com>
(cherry picked from commit e653a194e4)
This commit is contained in:
Alberto Planas 2023-01-16 11:16:53 +01:00 committed by Zbigniew Jędrzejewski-Szmek
parent 432ec5a654
commit 4f420958f9
1 changed files with 6 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
src/shared/creds-util.c
View File

@ -609,16 +609,13 @@ int encrypt_credential_and_warn(
#if HAVE_TPM2
bool try_tpm2;
if (sd_id128_equal(with_key, _CRED_AUTO)) {
/* If automatic mode is selected and we are running in a container, let's not try TPM2. OTOH
* if user picks TPM2 explicitly, let's always honour the request and try. */
/* If automatic mode is selected lets see if a TPM2 it is present. If we are running in a
* container tpm2_support will detect this, and will return a different flag combination of
* TPM2_SUPPORT_FULL, effectively skipping the use of TPM2 when inside one. */
r = detect_container();
if (r < 0)
log_debug_errno(r, "Failed to determine whether we are running in a container, ignoring: %m");
else if (r > 0)
log_debug("Running in container, not attempting to use TPM2.");
try_tpm2 = r <= 0;
try_tpm2 = tpm2_support() == TPM2_SUPPORT_FULL;
if (!try_tpm2)
log_debug("System lacks TPM2 support or running in a container, not attempting to use TPM2.");
} else if (sd_id128_equal(with_key, _CRED_AUTO_INITRD)) {
/* If automatic mode for initrds is selected, we'll use the TPM2 key if the firmware does it,
* otherwise we'll use a fixed key */