Kai Lüke d09e025b85 cryptsetup: Remap bad PCR set early to EPERM ...

Currently libcryptsetup's look treats ENOANO special because it's used
to signal PIN requirement. But the bad PCR set can also contain ENOANO
for a mismatch from a PolicyOR branch.
To continue iterating, remap the bad PCR set to EPERM early. This would
in theory also allow us to simplify the matching for the iteration
condition but we leave this as is for now to prevent a future
regression.

2026-07-10 08:07:47 +02:00

..

ac-power

…

analyze

meson: adjust naming of '*extract*' variables

2026-07-07 13:40:13 +02:00

ask-password

polkit: check if user authenticated as admin

2026-06-25 10:39:11 +01:00

backlight

…

basic

socket-util: fix socket_xattr_supported() in initramfs

2026-07-08 17:54:27 +01:00

battery-check

…

binfmt

…

bless-boot

bless-boot: avoid false maybe-uninitialized warning

2026-07-03 03:02:57 +09:00

boot

stub: Set up all detected consoles

2026-07-10 03:36:04 +02:00

bootctl

bootctl: Fix prepend when installing systemd-boot for the first time

2026-07-08 11:06:42 +01:00

bpf

…

busctl

meson: adjust naming of '*extract*' variables

2026-07-07 13:40:13 +02:00

cgls

…

cgtop

…

core

tree-wide: fix some double word errors like "the the"

2026-07-09 13:09:52 +01:00

coredump

meson: adjust naming of '*extract*' variables

2026-07-07 13:40:13 +02:00

coverage

…

creds

tree-wide: check if necessary cflags dependencies are set

2026-07-03 21:50:45 +09:00

cryptenroll

cryptsetup/cryptenroll: Iterate over TPM tokens when they don't match

2026-07-10 08:07:47 +02:00

cryptsetup

cryptsetup: Remap bad PCR set early to EPERM

2026-07-10 08:07:47 +02:00

debug-generator

recurse-dir: optionally, only enumerate dentries of a specific type

2026-06-22 14:40:16 +02:00

delta

…

detect-virt

…

dissect

dissect: do not follow copy-to directory symlinks

2026-07-09 11:01:29 +02:00

environment-d-generator

…

escape

…

factory-reset

…

firstboot

firstboot: add new systemd.firstboot=headless mode

2026-07-02 09:52:21 +01:00

fsck

fsck: don't apply invalid mode or repair values

2026-07-08 12:13:43 +01:00

fstab-generator

misc: fix minor error handling issues

2026-06-16 11:44:08 +01:00

fundamental

tree-wide: fix some double word errors like "the the"

2026-07-09 13:09:52 +01:00

fuzz

tree-wide: check if necessary cflags dependencies are set

2026-07-03 21:50:45 +09:00

getty-generator

…

gpt-auto-generator

gpt-auto-generator: fix error propagation in add_root_mount()

2026-06-16 10:26:23 +02:00

growfs

tree-wide: check if necessary cflags dependencies are set

2026-07-03 21:50:45 +09:00

hibernate-resume

meson: rename extract+objects to export+import

2026-07-07 13:40:13 +02:00

home

meson: adjust naming of '*extract*' variables

2026-07-07 13:40:13 +02:00

hostname

polkit: check if user authenticated as admin

2026-06-25 10:39:11 +01:00

hwdb

…

id128

…

imds

meson: rename extract+objects to export+import

2026-07-07 13:40:13 +02:00

import

Adjust naming of meson variables and allow systemd-report* binaries to be built standalone (#42874)

2026-07-07 21:35:41 +02:00

include

include: do not override kernel headers with libaudit headers

2026-07-03 17:25:34 +09:00

integritysetup

meson: rename extract+objects to export+import

2026-07-07 13:40:13 +02:00

journal

Assorted journal/portable hardening fixes flagged by kres (#42915)

2026-07-09 10:59:02 +02:00

journal-remote

journal-remote: do not create /var/log/journal/remote

2026-07-09 09:09:34 +02:00

kernel-install

recurse-dir: optionally, only enumerate dentries of a specific type

2026-06-22 14:40:16 +02:00

keyutil

tree-wide: Beef up openssl logging

2026-06-22 11:40:57 +02:00

libc

…

libsystemd

Assorted coverity fixes (#42933)

2026-07-09 11:01:03 +02:00

libsystemd-network

meson: rename extract+objects to export+import

2026-07-07 13:40:13 +02:00

libudev

…

locale

meson: adjust naming of '*extract*' variables

2026-07-07 13:40:13 +02:00

login

Assorted logind hardening fixes flagged by kres (#42879)

2026-07-09 11:07:06 +02:00

machine

meson: adjust naming of '*extract*' variables

2026-07-07 13:40:13 +02:00

machine-id-setup

…

measure

tree-wide: check if necessary cflags dependencies are set

2026-07-03 21:50:45 +09:00

modules-load

…

mount

…

mountfsd

polkit: check if user authenticated as admin

2026-06-25 10:39:11 +01:00

mstack

…

mute-console

…

network

meson: adjust naming of '*extract*' variables

2026-07-07 13:40:13 +02:00

notify

…

nspawn

meson: adjust naming of '*extract*' variables

2026-07-07 13:40:13 +02:00

nsresourced

sd-event: use CLOCK_BOOTTIME for rate limits

2026-07-08 15:38:39 +01:00

nss-myhostname

…

nss-mymachines

…

nss-resolve

nss-resolve: use resolve-varlink-util.h helpers

2026-06-26 16:03:18 -04:00

nss-systemd

nss-systemd: avoid ELF TLS for recursion guard

2026-06-20 15:14:14 +02:00

oom

meson: adjust naming of '*extract*' variables

2026-07-07 13:40:13 +02:00

path

…

pcrextend

meson: use tpm2_cflags dependency rather than tpm2

2026-07-03 21:50:45 +09:00

pcrlock

pcrlock: handle piped PE input

2026-07-09 11:02:46 +02:00

portable

portable: fix marker_matches_images() and propagate errors correctly

2026-07-07 18:03:00 +01:00

pstore

…

ptyfwd

…

quotacheck

quotacheck: don't apply an invalid quotacheck.mode= value

2026-07-01 18:18:00 +01:00

random-seed

random-seed: fix wrong error variable in log_error_errno()

2026-06-15 14:16:28 +02:00

remount-fs

…

repart

meson: rename extract+objects to export+import

2026-07-07 13:40:13 +02:00

reply-password

…

report

meson: build .standalone versions of the report binaries

2026-07-07 13:40:13 +02:00

resolve

tree-wide: fix some double word errors like "the the"

2026-07-09 13:09:52 +01:00

rfkill

…

rpm

…

run

calendarspec: warn on weekday/date conflict in systemd-analyze and systemd-run

2026-07-03 07:39:49 +02:00

run-generator

…

sbsign

sbsign: write unaligned signature size into WIN_CERTIFICATE header

2026-07-07 18:45:14 +02:00

shared

cryptsetup: Remap bad PCR set early to EPERM

2026-07-10 08:07:47 +02:00

shutdown

meson: rename extract+objects to export+import

2026-07-07 13:40:13 +02:00

sleep

meson: rename extract+objects to export+import

2026-07-07 13:40:13 +02:00

socket-activate

…

socket-proxy

…

ssh-generator

meson: rename extract+objects to export+import

2026-07-07 13:40:13 +02:00

stdio-bridge

…

storage

recurse-dir: optionally, only enumerate dentries of a specific type

2026-06-22 14:40:16 +02:00

storagetm

misc: fix minor error handling issues

2026-06-16 11:44:08 +01:00

sulogin-shell

…

sysctl

…

sysext

mount-util/sysext: Clone sub mounts as private to preserve nested ones

2026-07-10 03:34:54 +02:00

sysinstall

sysinstall: Disable timeout for connection with repart

2026-07-08 08:27:13 +02:00

system-update-generator

…

systemctl

meson: adjust naming of '*extract*' variables

2026-07-07 13:40:13 +02:00

systemd

tpm2-setup: Create and persist an endorsement key

2026-07-01 17:36:50 +02:00

sysupdate

sysupdate: handle slashes after pattern fields

2026-07-09 14:36:36 +02:00

sysusers

meson: rename extract+objects to export+import

2026-07-07 13:40:13 +02:00

test

mount-util: Compact list of sub mounts after dropping

2026-07-10 03:34:54 +02:00

timedate

polkit: check if user authenticated as admin

2026-06-25 10:39:11 +01:00

timesync

meson: adjust naming of '*extract*' variables

2026-07-07 13:40:13 +02:00

tmpfiles

tmpfiles: add hardening in glob_item_recursively

2026-07-08 22:50:55 +01:00

tpm2-setup

tree-wide: check if necessary cflags dependencies are set

2026-07-03 21:50:45 +09:00

tty-ask-password-agent

…

udev

tree-wide: fix some double word errors like "the the"

2026-07-09 13:09:52 +01:00

ukify

measure: Support binding signed policies to individual phases

2026-07-02 21:28:42 +02:00

update-done

…

update-utmp

…

user-sessions

…

userdb

sd-event: use CLOCK_BOOTTIME for rate limits

2026-07-08 15:38:39 +01:00

validatefs

…

varlinkctl

varlinkctl: add 'list-sockets' verb

2026-06-23 23:10:01 +02:00

vconsole

…

veritysetup

tree-wide: check if necessary cflags dependencies are set

2026-07-03 21:50:45 +09:00

version

…

vmspawn

meson: adjust naming of '*extract*' variables

2026-07-07 13:40:13 +02:00

volatile-root

…

vpick

vpick: take separate root_fd and dir_fd arguments

2026-06-24 12:59:55 +02:00

xdg-autostart-generator

meson: rename extract+objects to export+import

2026-07-07 13:40:13 +02:00