cryptenroll: add --unlock-headless as a new pseudo-unlock mechanism

THis simply tries TPM2 if available, and falls back to empty password.

man/systemd-cryptenroll.xml

@@ -317,6 +317,18 @@
 
         <xi:include href="version-info.xml" xpointer="v256"/></listitem>
       </varlistentry>
+
+      <varlistentry>
+        <term><option>--unlock-headless</option></term>
+
+        <listitem><para>Try the unlock mechanisms suitable for headless operation in turn, without requiring
+        any interactive input. If a TPM2 device is available the volume is unlocked via TPM2, and otherwise
+        (or if TPM2 unlocking fails) an empty password is attempted. This is primarily useful in automated
+        provisioning scenarios where a volume is first set up with a TPM2 enrollment or an empty password and
+        a stronger unlock mechanism shall be enrolled subsequently.</para>
+
+        <xi:include href="version-info.xml" xpointer="v262"/></listitem>
+      </varlistentry>
     </variablelist>
   </refsect1>
 

src/cryptenroll/cryptenroll.c

@@ -397,6 +397,14 @@ static int parse_argv(int argc, char *argv[]) {
                         break;
                 }
 
+                OPTION_LONG("unlock-headless", NULL, "Try the 'headless' unlock mechanisms in turn"):
+                        if (arg_unlock_type != UNLOCK_PASSWORD)
+                                return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
+                                                       "Multiple unlock methods specified at once, refusing.");
+
+                        arg_unlock_type = UNLOCK_HEADLESS;
+                        break;
+
                 OPTION_GROUP("Simple Enrollment"): {}
 
                 OPTION_LONG("password", NULL,
@@ -758,6 +766,21 @@ int prepare_luks(
                 r = load_volume_key_tpm2(c, cd, &vk);
                 break;
 
+        case UNLOCK_HEADLESS:
+                if (tpm2_is_mostly_supported()) {
+                        log_info("TPM2 support available, trying unlocking via TPM2…");
+
+                        r = load_volume_key_tpm2(c, cd, &vk);
+                        if (r >= 0)
+                                break;
+
+                        log_info("TPM2 unlocking didn't work, trying unlocking via empty password…");
+                } else
+                        log_info("TPM2 support not available, trying unlocking via empty password…");
+
+                r = load_volume_key_empty(c, cd, &vk);
+                break;
+
         default:
                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Unknown LUKS unlock method");
         }

src/cryptenroll/cryptenroll.h

@@ -20,6 +20,7 @@ typedef enum UnlockType {
         UNLOCK_FIDO2,
         UNLOCK_TPM2,
         UNLOCK_EMPTY,
+        UNLOCK_HEADLESS,
         _UNLOCK_TYPE_MAX,
         _UNLOCK_TYPE_INVALID = -EINVAL,
 } UnlockType;