From 34010a283bd54589c12c4620e3bdfbe2424b172e Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Tue, 10 Mar 2026 18:17:04 +0100 Subject: [PATCH] creds-util: only lock against public key PCR stuff if we are booted with UEFI supporting TPMs The UKI public key PCR stuff only works if we get PCR measurements from the pre-boot environment, hence automatically disable the logic by default if we don't have that. (cherry picked from commit 3b20cc4526e8068474d4c9b1f9eaa49cc6afcaa4) --- src/shared/creds-util.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/src/shared/creds-util.c b/src/shared/creds-util.c index 6b42647effa..b10d39e9cd6 100644 --- a/src/shared/creds-util.c +++ b/src/shared/creds-util.c @@ -901,7 +901,10 @@ int encrypt_credential_and_warn( try_tpm2 = CRED_KEY_REQUIRES_TPM2(with_key); if (try_tpm2) { - if (CRED_KEY_WANTS_TPM2_PK(with_key) || CRED_KEY_REQUIRES_TPM2_PK(with_key)) { + /* If the firmware does not support TPMs, then UKI measurements are not going to work, hence + * PCR 11 public key stuff cannot work. Because of that, if PK is only wanted (but not + * required) we won't try it. */ + if ((CRED_KEY_WANTS_TPM2_PK(with_key) && tpm2_is_fully_supported()) || CRED_KEY_REQUIRES_TPM2_PK(with_key)) { /* Load public key for PCR policies, if one is specified, or explicitly requested */ @@ -926,6 +929,8 @@ int encrypt_credential_and_warn( if (r < 0) return log_error_errno(r, "Could not find best pcr bank: %m"); + log_debug("Selected literal PCR mask: 0x%x, PK PCR mask: 0x%x", tpm2_hash_pcr_mask, tpm2_pubkey_pcr_mask); + TPML_PCR_SELECTION tpm2_hash_pcr_selection; tpm2_tpml_pcr_selection_from_mask(tpm2_hash_pcr_mask, tpm2_pcr_bank, &tpm2_hash_pcr_selection);