mirror of
https://github.com/systemd/systemd.git
synced 2026-06-30 19:57:29 +00:00
e3ebdb8ec5
setup_swtpm() decided whether a software TPM had already been manufactured by checking whether the state directory was empty. But manufacture_swtpm() writes swtpm's config files before forking swtpm_setup, so an interrupted manufacture leaves the directory non-empty yet without a usable TPM. The next boot then mistook it for a complete TPM and started swtpm against a broken state directory. Keying off a swtpm state file like tpm2-00.permall is no better, as swtpm_setup gives no guarantee any single one is written atomically or last. Instead, have manufacture_swtpm() write a marker (.manufactured) as its very last step, once swtpm_setup has exited successfully, and gate on it: re-manufacture when it is missing in the initrd, and refuse rather than start a broken TPM outside it. Signed-off-by: Paul Meyer <katexochen0@gmail.com>