systemd/SOURCES/0645-creds-util-do-not-try-TPM2-if-there-is-not-support.patch

50 lines
2.4 KiB
Diff

From 5d5a32888ec46d1cce61d46c92f6ad1df986213e Mon Sep 17 00:00:00 2001
From: Alberto Planas <aplanas@suse.com>
Date: Mon, 16 Jan 2023 11:16:53 +0100
Subject: [PATCH] creds-util: do not try TPM2 if there is not support
During the credentials encryption, if systemd it is compiled with TPM2
support, it will try to use it depending on the key flags passed.
The current code only checks if the system has a functional TPM2 if the
case of the INITRD flag.
This patch do a similar check in the case that it is outside initrd (but
still automatic).
Signed-off-by: Alberto Planas <aplanas@suse.com>
(cherry picked from commit e653a194e490fae7d166f40762c334006d592051)
Related: RHEL-16182
---
src/shared/creds-util.c | 15 ++++++---------
1 file changed, 6 insertions(+), 9 deletions(-)
diff --git a/src/shared/creds-util.c b/src/shared/creds-util.c
index 20b3b83369..075fd2327a 100644
--- a/src/shared/creds-util.c
+++ b/src/shared/creds-util.c
@@ -609,16 +609,13 @@ int encrypt_credential_and_warn(
#if HAVE_TPM2
bool try_tpm2;
if (sd_id128_equal(with_key, _CRED_AUTO)) {
- /* If automatic mode is selected and we are running in a container, let's not try TPM2. OTOH
- * if user picks TPM2 explicitly, let's always honour the request and try. */
+ /* If automatic mode is selected lets see if a TPM2 it is present. If we are running in a
+ * container tpm2_support will detect this, and will return a different flag combination of
+ * TPM2_SUPPORT_FULL, effectively skipping the use of TPM2 when inside one. */
- r = detect_container();
- if (r < 0)
- log_debug_errno(r, "Failed to determine whether we are running in a container, ignoring: %m");
- else if (r > 0)
- log_debug("Running in container, not attempting to use TPM2.");
-
- try_tpm2 = r <= 0;
+ try_tpm2 = tpm2_support() == TPM2_SUPPORT_FULL;
+ if (!try_tpm2)
+ log_debug("System lacks TPM2 support or running in a container, not attempting to use TPM2.");
} else if (sd_id128_equal(with_key, _CRED_AUTO_INITRD)) {
/* If automatic mode for initrds is selected, we'll use the TPM2 key if the firmware does it,
* otherwise we'll use a fixed key */