mirror of
https://github.com/systemd/systemd.git
synced 2024-12-25 01:34:28 +03:00
cryptenroll: fix bind default TPM2 signed policy to PCR 11
If `--tpm2-public-key=` is not specified, but `tpm2-pcr-public-key.pem` exists
in /{etc,run,usr/lib}/systemd/, the default PCR 11 is not being set.
Fixes 9e437994
This commit is contained in:
parent
9674c06510
commit
cb7aabf180
@ -194,7 +194,7 @@ int enroll_tpm2(struct crypt_device *cd,
|
||||
r = tpm2_load_pcr_public_key(pubkey_path, &pubkey, &pubkey_size);
|
||||
if (r < 0) {
|
||||
if (pubkey_path || signature_path || r != -ENOENT)
|
||||
return log_error_errno(r, "Failed read TPM PCR public key: %m");
|
||||
return log_error_errno(r, "Failed to read TPM PCR public key: %m");
|
||||
|
||||
log_debug_errno(r, "Failed to read TPM2 PCR public key, proceeding without: %m");
|
||||
pubkey_pcr_mask = 0;
|
||||
|
@ -500,7 +500,7 @@ static int parse_argv(int argc, char *argv[]) {
|
||||
}
|
||||
}
|
||||
|
||||
if (auto_public_key_pcr_mask && arg_tpm2_public_key) {
|
||||
if (auto_public_key_pcr_mask) {
|
||||
assert(arg_tpm2_public_key_pcr_mask == 0);
|
||||
arg_tpm2_public_key_pcr_mask = INDEX_TO_MASK(uint32_t, TPM2_PCR_KERNEL_BOOT);
|
||||
}
|
||||
|
Loading…
Reference in New Issue
Block a user