SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

cryptsetup: Remap bad PCR set early to EPERM

Browse Source 
Currently libcryptsetup's look treats ENOANO special because it's used
to signal PIN requirement. But the bad PCR set can also contain ENOANO
for a mismatch from a PolicyOR branch.
To continue iterating, remap the bad PCR set to EPERM early. This would
in theory also allow us to simplify the matching for the iteration
condition but we leave this as is for now to prevent a future
regression.
This commit is contained in:
Kai Lüke
2026-07-10 08:07:47 +02:00
committed by Kai Lüke
parent 19eac27e62
commit d09e025b85
2 changed files with 15 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/cryptsetup/cryptsetup-tokens/luks2-tpm2.c
+5 -2
View File
@@ -117,8 +117,11 @@ int acquire_luks2_key(
return log_error_errno(SYNTHETIC_ERRNO(ENOANO), "Bad PIN."); /* cryptsetup docs say we should return ENOANO on bad PIN */
if (r == -ENOLCK)
return log_error_errno(r, "TPM is in dictionary attack lock-out mode.");
if (ERRNO_IS_NEG_TPM2_UNSEAL_BAD_PCR(r))
return log_error_errno(r, "TPM policy does not match current system state. Either system has been tempered with or policy out-of-date: %m");
if (ERRNO_IS_NEG_TPM2_UNSEAL_BAD_PCR(r)) {
log_error_errno(r, "TPM policy does not match current system state. Either system has been tempered with or policy out-of-date: %m");
/* Normalize to -EPERM so callers don't confuse it with -ENOANO's "needs PIN" meaning. */
return -EPERM;
}
if (r == -ENOSTR)
return log_error_errno(r, "No signature for current PCR policy in TPM2 signature JSON, token does not apply to current boot state: %m");
if (r < 0)
src/shared/cryptsetup-tpm2.c
+10 -4
View File
@@ -175,8 +175,11 @@ int acquire_tpm2_key(
ret_decrypted_key);
if (r == -EREMOTE)
return log_error_errno(r, "TPM key integrity check failed or NV index unusable. Key enrolled in superblock most likely does not belong to this TPM.");
if (ERRNO_IS_NEG_TPM2_UNSEAL_BAD_PCR(r))
return log_error_errno(r, "TPM policy does not match current system state. Either system has been tempered with or policy out-of-date: %m");
if (ERRNO_IS_NEG_TPM2_UNSEAL_BAD_PCR(r)) {
log_error_errno(r, "TPM policy does not match current system state. Either system has been tempered with or policy out-of-date: %m");
/* Normalize to -EPERM so callers don't confuse it with -ENOANO's "needs PIN" meaning. */
return -EPERM;
}
if (r == -ENOSTR)
return log_error_errno(r, "No signature for current PCR policy in TPM2 signature JSON, token does not apply to current boot state: %m");
if (r < 0)
@@ -230,8 +233,11 @@ int acquire_tpm2_key(
ret_decrypted_key);
if (r == -EREMOTE)
return log_error_errno(r, "TPM key integrity check failed or NV index unusable. Key enrolled in superblock most likely does not belong to this TPM.");
if (ERRNO_IS_NEG_TPM2_UNSEAL_BAD_PCR(r))
return log_error_errno(r, "TPM policy does not match current system state. Either system has been tempered with or policy out-of-date: %m");
if (ERRNO_IS_NEG_TPM2_UNSEAL_BAD_PCR(r)) {
log_error_errno(r, "TPM policy does not match current system state. Either system has been tempered with or policy out-of-date: %m");
/* Normalize to -EPERM so callers don't confuse it with -ENOANO's "needs PIN" meaning. */
return -EPERM;
}
if (r == -ENOSTR)
return log_error_errno(r, "No signature for current PCR policy in TPM2 signature JSON, token does not apply to current boot state: %m");
if (r == -ENOLCK)