| Message ID | 20240527143247.3098210-1-Quirin.Gylstorff@siemens.com (mailing list archive) |
|---|---|
| State | Superseded |
| Headers | show |
| Series | [isar-cip-core,v3] encrypt_partition.clevis: select tpm2_device for encryptition | expand |
Hi Jan, On 5/27/24 4:32 PM, Quirin Gylstorff via lists.cip-project.org wrote: > From: Quirin Gylstorff <quirin.gylstorff@siemens.com> > > This enables the feature to preselect the TPM2 device also for clevis in Debian > bookworm and later. > > As clevis is intented to provided TPM2 based disk encryption > for Debian bullseye and earlier the TPM2 device selection was not avaiable > or implemented. Since clevis v19(part of Debian bookworm) the TPM2 > device can be selected with the variable TPM2TOOLS_TCTI[1]. > > Setting the variable as no effect in older versions, so > no version check was implemented. > > No interface change as systemd-cryptenroll already allows > selecting the tpm2 device. > > [1]: https://github.com/latchset/clevis/commit/c6fc63fc055c18927decc7bcaa07821d5ae37614 > > Reported-by: Gokhan Cetin <gokhan.cetin@siemens.com> > Signed-off-by: Quirin Gylstorff <quirin.gylstorff@siemens.com> > --- > Changes v3: > - reword commit message that the disable setting was intentional > > Changes v2: > - reword commit message to clarify intent Please don't merge - in my latest testing I had some disk not found errors. Quirin > .../files/encrypt_partition.clevis.script | 8 ++++---- > 1 file changed, 4 insertions(+), 4 deletions(-) > > diff --git a/recipes-initramfs/initramfs-crypt-hook/files/encrypt_partition.clevis.script b/recipes-initramfs/initramfs-crypt-hook/files/encrypt_partition.clevis.script > index ddb3eab..a7a5009 100644 > --- a/recipes-initramfs/initramfs-crypt-hook/files/encrypt_partition.clevis.script > +++ b/recipes-initramfs/initramfs-crypt-hook/files/encrypt_partition.clevis.script > @@ -13,8 +13,8 @@ > open_tpm2_partition() { > partition_device="$1" > crypt_mount_name="$2" > - #tpm_device="$3" > - if ! /usr/bin/clevis luks unlock -n "$crypt_mount_name" \ > + tpm_device="$3" > + if ! TPM2TOOLS_TCTI=$tpm_device usr/bin/clevis luks unlock -n "$crypt_mount_name" \ > -d "$partition_device"; then > panic "Can't decrypt '$partition_device' !" > fi > @@ -23,11 +23,11 @@ open_tpm2_partition() { > enroll_tpm2_token() { > partition_device="$1" > passphrase="$2" > - #tpm_device="$3" > + tpm_device="$3" > tpm_key_algorithm="$4" > pcr_bank_hash_type="$5" > if [ -x /usr/bin/clevis ]; then > - clevis luks bind -d "$partition_device" tpm2 '{"key":"'"$tpm_key_algorithm"'", "pcr_bank":"'"$pcr_bank_hash_type"'","pcr_ids":"7"}' < "$passphrase" > + TPM2TOOLS_TCTI=$tpm_device clevis luks bind -d "$partition_device" tpm2 '{"key":"'"$tpm_key_algorithm"'", "pcr_bank":"'"$pcr_bank_hash_type"'","pcr_ids":"7"}' < "$passphrase" > else > panic "clevis not available cannot enroll tpm2 key!" > fi > > > > -=-=-=-=-=-=-=-=-=-=-=- > Links: You receive all messages sent to this group. > View/Reply Online (#15958): https://lists.cip-project.org/g/cip-dev/message/15958 > Mute This Topic: https://lists.cip-project.org/mt/106330929/1753640 > Group Owner: cip-dev+owner@lists.cip-project.org > Unsubscribe: https://lists.cip-project.org/g/cip-dev/leave/8129121/1753640/1405269326/xyzzy [quirin.gylstorff@siemens.com] > -=-=-=-=-=-=-=-=-=-=-=- >
diff --git a/recipes-initramfs/initramfs-crypt-hook/files/encrypt_partition.clevis.script b/recipes-initramfs/initramfs-crypt-hook/files/encrypt_partition.clevis.script index ddb3eab..a7a5009 100644 --- a/recipes-initramfs/initramfs-crypt-hook/files/encrypt_partition.clevis.script +++ b/recipes-initramfs/initramfs-crypt-hook/files/encrypt_partition.clevis.script @@ -13,8 +13,8 @@ open_tpm2_partition() { partition_device="$1" crypt_mount_name="$2" - #tpm_device="$3" - if ! /usr/bin/clevis luks unlock -n "$crypt_mount_name" \ + tpm_device="$3" + if ! TPM2TOOLS_TCTI=$tpm_device usr/bin/clevis luks unlock -n "$crypt_mount_name" \ -d "$partition_device"; then panic "Can't decrypt '$partition_device' !" fi @@ -23,11 +23,11 @@ open_tpm2_partition() { enroll_tpm2_token() { partition_device="$1" passphrase="$2" - #tpm_device="$3" + tpm_device="$3" tpm_key_algorithm="$4" pcr_bank_hash_type="$5" if [ -x /usr/bin/clevis ]; then - clevis luks bind -d "$partition_device" tpm2 '{"key":"'"$tpm_key_algorithm"'", "pcr_bank":"'"$pcr_bank_hash_type"'","pcr_ids":"7"}' < "$passphrase" + TPM2TOOLS_TCTI=$tpm_device clevis luks bind -d "$partition_device" tpm2 '{"key":"'"$tpm_key_algorithm"'", "pcr_bank":"'"$pcr_bank_hash_type"'","pcr_ids":"7"}' < "$passphrase" else panic "clevis not available cannot enroll tpm2 key!" fi