From 2cd7161fd67cd00c3521d3d962a8a8097213aefa Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Kai=20L=C3=BCke?= Date: Mon, 20 Apr 2026 18:45:22 +0900 Subject: [PATCH] tpm2-util: Align tpm2_import with tpm2_load to report on foreign keys When we encounter a key for a foreign TPM we report that as EREMOTE in tpm2_load but not yet in tpm2_import. This causes cryptsetup to give up on using the TPM instead of being able to continue with out tokens. Do the same mapping as in tpm2_load in tpm2_import to report EREMOTE on foreign keys. (cherry picked from commit 93bc6a3415a717106afdeaaf9bb3b7f025c12c70) (cherry picked from commit 793efd3553df219dabaf1856a6422aa3a9cc6e6a) (cherry picked from commit 87da8380511bc48132d9d68c3ae473cd41daf411) (cherry picked from commit fd5221a9ea9b1e3afa6bb0d4d9006ac7501a1f6b) --- src/shared/tpm2-util.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/shared/tpm2-util.c b/src/shared/tpm2-util.c index ffab4fecaa0..313e821e9a4 100644 --- a/src/shared/tpm2-util.c +++ b/src/shared/tpm2-util.c @@ -2460,6 +2460,9 @@ static int tpm2_import( seed, symmetric ?: &(TPMT_SYM_DEF_OBJECT){ .algorithm = TPM2_ALG_NULL, }, ret_private); + if ((rc & ~(TPM2_RC_N_MASK|TPM2_RC_P)) == TPM2_RC_INTEGRITY) /* Return a recognizable error if this key does not belong to the local TPM */ + return log_debug_errno(SYNTHETIC_ERRNO(EREMOTE), + "Key invalid or does not belong to current TPM."); if (rc != TSS2_RC_SUCCESS) return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE), "Failed to import key into TPM: %s", sym_Tss2_RC_Decode(rc));