dilim/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd.git synced 2026-08-05 07:30:30 +00:00
Code Issues Packages Projects Releases Wiki Activity

tree-wide: relax TPM available checks for many cases

Browse Source 
In many cases it's essential to know if the firmware supports a TPM, but
in others we should accept it if the firmware doesn't have TPM support,
in particular if we want to run the OS with a software TPM.

Hence, add tpm2_is_mostly_supported() as function similar to
tpm2_is_fully_supported(), with the only difference that the former
doesn't insist on a firmware supported TPM. Then, change a number of
users over to this (but not all).
This commit is contained in:
Lennart Poettering
2026-03-09 18:51:49 +01:00
parent 750795d103
commit ca03d178a0
6 changed files with 10 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
src/analyze/analyze-nvpcrs.c
View File

@@ -56,7 +56,7 @@ int verb_nvpcrs(int argc, char *argv[], uintptr_t _data, void *userdata) {
_cleanup_(table_unrefp) Table *table = NULL;
int r;
bool have_tpm2 = tpm2_is_fully_supported();
bool have_tpm2 = tpm2_is_mostly_supported();
if (!have_tpm2)
log_notice("System lacks full TPM2 support, not showing NvPCR state.");

4
src/analyze/analyze-pcrs.c
View File

@@ -101,8 +101,8 @@ int verb_pcrs(int argc, char *argv[], uintptr_t _data, void *userdata) {
const char *alg = NULL;
int r;
if (!tpm2_is_fully_supported())
log_notice("System lacks full TPM2 support, not showing PCR state.");
if (!tpm2_is_mostly_supported())
log_notice("System lacks sufficient TPM2 support, not showing PCR state.");
else {
r = get_pcr_alg(&alg);
if (r < 0)

2
src/pcrextend/pcrextend.c
View File

@@ -531,7 +531,7 @@ static int run(int argc, char *argv[]) {
if (arg_event_type >= 0)
event = arg_event_type;
if (arg_graceful && !tpm2_is_fully_supported()) {
if (arg_graceful && !tpm2_is_mostly_supported()) {
log_notice("No complete TPM2 support detected, exiting gracefully.");
return EXIT_SUCCESS;
}

2
src/shared/creds-util.c
View File

@@ -894,7 +894,7 @@ int encrypt_credential_and_warn(
* container tpm2_support will detect this, and will return a different flag combination of
* TPM2_SUPPORT_FULL, effectively skipping the use of TPM2 when inside one. */
try_tpm2 = tpm2_is_fully_supported();
try_tpm2 = tpm2_is_mostly_supported();
if (!try_tpm2)
log_debug("System lacks TPM2 support or running in a container, not attempting to use TPM2.");
} else

4
src/shared/tpm2-util.h
View File

@@ -496,6 +496,7 @@ typedef enum Tpm2Support {
/* Combined flags for generic (i.e. not tool-specific) support */
TPM2_SUPPORT_FULL = TPM2_SUPPORT_API|TPM2_SUPPORT_LIBTSS2_ALL,
TPM2_SUPPORT_SOFTWARE = TPM2_SUPPORT_FULL & ~TPM2_SUPPORT_FIRMWARE, /* Same, just without PC firmware support */
} Tpm2Support;
Tpm2Support tpm2_support_full(Tpm2Support mask);
@@ -505,6 +506,9 @@ static inline Tpm2Support tpm2_support(void) {
static inline bool tpm2_is_fully_supported(void) {
return tpm2_support() == TPM2_SUPPORT_FULL;
}
static inline bool tpm2_is_mostly_supported(void) {
return (tpm2_support() & TPM2_SUPPORT_SOFTWARE) == TPM2_SUPPORT_SOFTWARE;
}
int verb_has_tpm2_generic(bool quiet);

2
src/tpm2-setup/tpm2-setup.c
View File

@@ -516,7 +516,7 @@ static int run(int argc, char *argv[]) {
if (r <= 0)
return r;
if (arg_graceful && !tpm2_is_fully_supported()) {
if (arg_graceful && !tpm2_is_mostly_supported()) {
log_notice("No complete TPM2 support detected, exiting gracefully.");
return EXIT_SUCCESS;
}