dilim/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd.git synced 2026-08-05 23:50:42 +00:00
Code Issues Packages Projects Releases Wiki Activity

tpm2: downgrade most log functions from error to debug

Browse Source 
Because most TPM2 functions here are 'library-like' functions, they should be
at debug level, not error level.

The only functions not reduced to logging at debug are tpm2_list_devices(),
since it is expected to print output, and the tpm2_parse_pcr_argument_*()
functions, since the system-wide parse_*_argument() functions generally log at
error level.
This commit is contained in:
Dan Streetman
2023-09-08 12:39:49 -04:00
committed by Luca Boccassi
parent d3dde190c1
commit f9a0ee7554
11 changed files with 220 additions and 214 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
src/cryptsetup/cryptsetup-tokens/luks2-tpm2.c
View File

@@ -45,11 +45,11 @@ int acquire_luks2_key(
assert(ret_decrypted_key_size);
if (!device) {
r = tpm2_find_device_auto(LOG_DEBUG, &auto_device);
r = tpm2_find_device_auto(&auto_device);
if (r == -ENODEV)
return -EAGAIN; /* Tell the caller to wait for a TPM2 device to show up */
if (r < 0)
return r;
return log_error_errno(r, "Could not find TPM2 device: %m");
device = auto_device;
}
@@ -77,11 +77,10 @@ int acquire_luks2_key(
if (pubkey_pcr_mask != 0) {
r = tpm2_load_pcr_signature(signature_path, &signature_json);
if (r < 0)
return r;
return log_error_errno(r, "Failed to load PCR signature: %m");
}
return tpm2_unseal(
device,
r = tpm2_unseal(device,
hash_pcr_mask,
pcr_bank,
pubkey, pubkey_size,
@@ -93,4 +92,8 @@ int acquire_luks2_key(
policy_hash, policy_hash_size,
srk_buf, srk_buf_size,
ret_decrypted_key, ret_decrypted_key_size);
if (r < 0)
return log_error_errno(r, "Failed to unseal secret using TPM2: %m");
return r;
}

30
src/cryptsetup/cryptsetup-tpm2.c
View File

@@ -91,11 +91,11 @@ int acquire_tpm2_key(
assert(salt || salt_size == 0);
if (!device) {
r = tpm2_find_device_auto(LOG_DEBUG, &auto_device);
r = tpm2_find_device_auto(&auto_device);
if (r == -ENODEV)
return -EAGAIN; /* Tell the caller to wait for a TPM2 device to show up */
if (r < 0)
return r;
return log_error_errno(r, "Could not find TPM2 device: %m");
device = auto_device;
}
@@ -126,12 +126,11 @@ int acquire_tpm2_key(
if (pubkey_pcr_mask != 0) {
r = tpm2_load_pcr_signature(signature_path, &signature_json);
if (r < 0)
return r;
return log_error_errno(r, "Failed to load pcr signature: %m");
}
if (!(flags & TPM2_FLAGS_USE_PIN))
return tpm2_unseal(
device,
if (!(flags & TPM2_FLAGS_USE_PIN)) {
r = tpm2_unseal(device,
hash_pcr_mask,
pcr_bank,
pubkey, pubkey_size,
@@ -147,6 +146,11 @@ int acquire_tpm2_key(
srk_buf_size,
ret_decrypted_key,
ret_decrypted_key_size);
if (r < 0)
return log_error_errno(r, "Failed to unseal secret using TPM2: %m");
return r;
}
for (int i = 5;; i--) {
_cleanup_(erase_and_freep) char *pin_str = NULL, *b64_salted_pin = NULL;
@@ -189,12 +193,14 @@ int acquire_tpm2_key(
srk_buf_size,
ret_decrypted_key,
ret_decrypted_key_size);
/* We get this error in case there is an authentication policy mismatch. This should
* not happen, but this avoids confusing behavior, just in case. */
if (IN_SET(r, -EPERM, -ENOLCK))
return r;
if (r < 0)
continue;
if (r < 0) {
log_error_errno(r, "Failed to unseal secret using TPM2: %m");
/* We get this error in case there is an authentication policy mismatch. This should
* not happen, but this avoids confusing behavior, just in case. */
if (!IN_SET(r, -EPERM, -ENOLCK))
continue;
}
return r;
}

6
src/cryptsetup/cryptsetup.c
View File

@@ -836,13 +836,13 @@ static int measure_volume_key(
_cleanup_(tpm2_context_unrefp) Tpm2Context *c = NULL;
r = tpm2_context_new(arg_tpm2_device, &c);
if (r < 0)
return r;
return log_error_errno(r, "Failed to create TPM2 context: %m");
_cleanup_strv_free_ char **l = NULL;
if (strv_isempty(arg_tpm2_measure_banks)) {
r = tpm2_get_good_pcr_banks_strv(c, UINT32_C(1) << arg_tpm2_measure_pcr, &l);
if (r < 0)
return r;
return log_error_errno(r, "Could not verify pcr banks: %m");
}
_cleanup_free_ char *joined = strv_join(l ?: arg_tpm2_measure_banks, ", ");
@@ -865,7 +865,7 @@ static int measure_volume_key(
r = tpm2_extend_bytes(c, l ?: arg_tpm2_measure_banks, arg_tpm2_measure_pcr, s, SIZE_MAX, volume_key, volume_key_size, TPM2_EVENT_VOLUME_KEY, s);
if (r < 0)
return r;
return log_error_errno(r, "Could not extend PCR: %m");
log_struct(LOG_INFO,
"MESSAGE_ID=" SD_MESSAGE_TPM_PCR_EXTEND_STR,