From 6171a5ec0a2da3b76de5101d3f638cfe4d1610fe Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Tue, 3 Nov 2026 14:16:29 +0100 Subject: [PATCH] pcrextend: suppress duplicate --bank= arguments If the same bank is specified twice we'd extend the PCR twice in that bank in one go, and write a userspace measurement log record that lists the same digest algorithm twice. systemd-pcrlock refuses such records ("Failed to add bank to event log record: File exists"), which in turn breaks everything that reads the event log, for example systemd-report-sign-tpm2. TEST-70-TPM2.pcrextend.sh deliberately calls --bank=sha256 --bank=sha256, and on systems without a firmware event log (where TEST-70-TPM2.pcrlock.sh is skipped and hence doesn't reset the log) TEST-70-TPM2.report-sign.sh then fails because the TPM2 signer gets EEXIST from io.systemd.PCRLock.ReadEventLog. --- src/pcrextend/pcrextend.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/pcrextend/pcrextend.c b/src/pcrextend/pcrextend.c index 0941732af9b..ec23c130d3e 100644 --- a/src/pcrextend/pcrextend.c +++ b/src/pcrextend/pcrextend.c @@ -176,6 +176,10 @@ static int parse_argv(int argc, char *argv[], char ***ret_args) { return introspect_cli(SD_JSON_FORMAT_OFF); } + /* Suppress duplicates: otherwise we'd extend the same bank twice, and write a measurement log + * record listing the same digest twice, which readers refuse. */ + strv_sort_uniq(arg_banks); + if (!!arg_file_system + arg_machine_id + arg_product_id + !!arg_login > 1) return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "--file-system=, --machine-id, --product-id, --login= may not be combined.");