SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

TEST-70-TPM2: skip pcrlock subtest if firmware TPM2 support is not available

Browse Source 
Since a couple of days the pcrlock subtest fails intermittently on
debian-testing and arch CI runs (unrelated PRs: #44152 and others), with
"systemd-pcrlock is-supported" printing "partial" and exiting with 97,
i.e. TPM2_SUPPORT_FIRMWARE is missing.

The console output of the affected boots shows that the TPM already
breaks down while the firmware runs:

    EFI stub: WARNING: Failed to measure data for event 1: 0x8000000000000007
    EFI stub: WARNING: Failed to measure data for event 0: 0x8000000000000007

i.e. the TCG2 protocol is there, but all measurements fail with
EFI_DEVICE_ERROR, systemd-stub reports no active PCR banks in
LoaderTpm2ActivePcrBanks, and ConditionSecurity=measured-os is hence
false for the whole boot. pcrlock can't do anything useful in that case,
so let's skip the subtest instead of failing, and log what
"systemd-analyze has-tpm2" reports so that this remains visible.

(cherry picked from commit 09fdbf4d715e962cc13fd678760754e59d0aeeaf)
This commit is contained in:
Lennart Poettering
2026-10-16 17:24:51 +01:00
committed by Luca Boccassi
parent d4da50bbc9
commit 1d40ff7a67
1 changed files with 9 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/units/TEST-70-TPM2.pcrlock.sh
+9
View File
@@ -17,6 +17,15 @@ if [[ ! -x "${SD_PCREXTEND:?}" ]] || [[ ! -x "${SD_PCRLOCK:?}" ]] || [[ ! -x "${
exit 77
fi
# systemd-pcrlock requires that the firmware measured the boot. Occasionally the TPM breaks down already
# during firmware execution in CI (all TCG2 measurements fail with EFI_DEVICE_ERROR, and systemd-stub
# reports no active PCR banks), in which case we can't test anything here.
if ! systemd-analyze has-tpm2 -q; then
systemd-analyze has-tpm2 ||:
echo "Firmware TPM2 support not available, skipping pcrlock tests"
exit 77
fi
at_exit() {
if [[ $? -ne 0 ]]; then
# Dump the event log on fail, to make debugging a bit easier