|
 |
ac3a84 |
From 31f0c1b06bfd90d52009b59b9a4bf26c297790a7 Mon Sep 17 00:00:00 2001
|
|
|
ac3a84 |
From: Lennart Poettering <lennart@poettering.net>
|
|
|
ac3a84 |
Date: Mon, 14 Nov 2022 17:26:49 +0100
|
|
|
ac3a84 |
Subject: [PATCH] tpm2-util: force default TCTI to be "device" with parameter
|
|
|
ac3a84 |
"/dev/tpmrm0"
|
|
|
ac3a84 |
|
|
|
ac3a84 |
Apparently some distros default to tss-abmrd. Let's bypass that and
|
|
|
ac3a84 |
always go to the kernel resource manager.
|
|
|
ac3a84 |
|
|
|
ac3a84 |
abmrd cannot really work for us, since we want to access the TPM already
|
|
|
ac3a84 |
in earliest boot i.e. in environments the abmrd service is not available
|
|
|
ac3a84 |
in.
|
|
|
ac3a84 |
|
|
|
ac3a84 |
Fixes: #25352
|
|
|
ac3a84 |
(cherry picked from commit 34906680afe60d724ea435b79b9b830a4bf2e7e9)
|
|
|
ac3a84 |
|
|
|
ac3a84 |
Related: #2138081
|
|
|
ac3a84 |
---
|
|
|
ac3a84 |
src/shared/tpm2-util.c | 13 ++++++++++++-
|
|
|
ac3a84 |
1 file changed, 12 insertions(+), 1 deletion(-)
|
|
|
ac3a84 |
|
|
|
ac3a84 |
diff --git a/src/shared/tpm2-util.c b/src/shared/tpm2-util.c
|
|
|
ac3a84 |
index 65e8d48347..9d73316146 100644
|
|
|
ac3a84 |
--- a/src/shared/tpm2-util.c
|
|
|
ac3a84 |
+++ b/src/shared/tpm2-util.c
|
|
|
ac3a84 |
@@ -152,8 +152,19 @@ int tpm2_context_init(const char *device, struct tpm2_context *ret) {
|
|
|
ac3a84 |
if (r < 0)
|
|
|
ac3a84 |
return log_error_errno(r, "TPM2 support not installed: %m");
|
|
|
ac3a84 |
|
|
|
ac3a84 |
- if (!device)
|
|
|
ac3a84 |
+ if (!device) {
|
|
|
ac3a84 |
device = secure_getenv("SYSTEMD_TPM2_DEVICE");
|
|
|
ac3a84 |
+ if (device)
|
|
|
ac3a84 |
+ /* Setting the env var to an empty string forces tpm2-tss' own device picking
|
|
|
ac3a84 |
+ * logic to be used. */
|
|
|
ac3a84 |
+ device = empty_to_null(device);
|
|
|
ac3a84 |
+ else
|
|
|
ac3a84 |
+ /* If nothing was specified explicitly, we'll use a hardcoded default: the "device" tcti
|
|
|
ac3a84 |
+ * driver and the "/dev/tpmrm0" device. We do this since on some distributions the tpm2-abrmd
|
|
|
ac3a84 |
+ * might be used and we really don't want that, since it is a system service and that creates
|
|
|
ac3a84 |
+ * various ordering issues/deadlocks during early boot. */
|
|
|
ac3a84 |
+ device = "device:/dev/tpmrm0";
|
|
|
ac3a84 |
+ }
|
|
|
ac3a84 |
|
|
|
ac3a84 |
if (device) {
|
|
|
ac3a84 |
const char *param, *driver, *fn;
|