|
 |
594167 |
From d3615420322bf3c9666fe5580317ed0aec20fe62 Mon Sep 17 00:00:00 2001
|
|
|
594167 |
From: Grigori Goronzy <greg@chown.ath.cx>
|
|
|
594167 |
Date: Fri, 18 Feb 2022 21:13:41 +0100
|
|
|
594167 |
Subject: [PATCH] cryptsetup: add manual TPM2 PIN configuration
|
|
|
594167 |
|
|
|
594167 |
Handle the case where TPM2 metadata is not available and explicitly
|
|
|
594167 |
provided in crypttab. This adds a new "tpm2-pin" option to crypttab
|
|
|
594167 |
options for this purpose.
|
|
|
594167 |
|
|
|
594167 |
(cherry picked from commit 4005d41ef0d007021deb0536800fc782ff670420)
|
|
|
594167 |
|
|
|
594167 |
Related: #2087652
|
|
|
594167 |
---
|
|
|
594167 |
man/crypttab.xml | 8 ++++++++
|
|
|
594167 |
src/cryptsetup/cryptsetup.c | 13 ++++++++++++-
|
|
|
594167 |
2 files changed, 20 insertions(+), 1 deletion(-)
|
|
|
594167 |
|
|
|
594167 |
diff --git a/man/crypttab.xml b/man/crypttab.xml
|
|
|
594167 |
index ac5c6ef666..22411166a8 100644
|
|
|
594167 |
--- a/man/crypttab.xml
|
|
|
594167 |
+++ b/man/crypttab.xml
|
|
|
594167 |
@@ -677,6 +677,14 @@
|
|
|
594167 |
of the current PCR state.</para></listitem>
|
|
|
594167 |
</varlistentry>
|
|
|
594167 |
|
|
|
594167 |
+ <varlistentry>
|
|
|
594167 |
+ <term><option>tpm2-pin=</option></term>
|
|
|
594167 |
+
|
|
|
594167 |
+ <listitem><para>Takes a boolean argument, defaults to <literal>false</literal>. Controls whether
|
|
|
594167 |
+ TPM2 volume unlocking is bound to a PIN in addition to PCRs. Similarly, this option is only useful
|
|
|
594167 |
+ when TPM2 enrollment metadata is not available.</para></listitem>
|
|
|
594167 |
+ </varlistentry>
|
|
|
594167 |
+
|
|
|
594167 |
<varlistentry>
|
|
|
594167 |
<term><option>token-timeout=</option></term>
|
|
|
594167 |
|
|
|
594167 |
diff --git a/src/cryptsetup/cryptsetup.c b/src/cryptsetup/cryptsetup.c
|
|
|
594167 |
index ede0f7ed0b..fc1f37730f 100644
|
|
|
594167 |
--- a/src/cryptsetup/cryptsetup.c
|
|
|
594167 |
+++ b/src/cryptsetup/cryptsetup.c
|
|
|
594167 |
@@ -82,6 +82,7 @@ static char *arg_fido2_rp_id = NULL;
|
|
|
594167 |
static char *arg_tpm2_device = NULL;
|
|
|
594167 |
static bool arg_tpm2_device_auto = false;
|
|
|
594167 |
static uint32_t arg_tpm2_pcr_mask = UINT32_MAX;
|
|
|
594167 |
+static bool arg_tpm2_pin = false;
|
|
|
594167 |
static bool arg_headless = false;
|
|
|
594167 |
static usec_t arg_token_timeout_usec = 30*USEC_PER_SEC;
|
|
|
594167 |
|
|
|
594167 |
@@ -387,6 +388,16 @@ static int parse_one_option(const char *option) {
|
|
|
594167 |
arg_tpm2_pcr_mask |= mask;
|
|
|
594167 |
}
|
|
|
594167 |
|
|
|
594167 |
+ } else if ((val = startswith(option, "tpm2-pin="))) {
|
|
|
594167 |
+
|
|
|
594167 |
+ r = parse_boolean(val);
|
|
|
594167 |
+ if (r < 0) {
|
|
|
594167 |
+ log_error_errno(r, "Failed to parse %s, ignoring: %m", option);
|
|
|
594167 |
+ return 0;
|
|
|
594167 |
+ }
|
|
|
594167 |
+
|
|
|
594167 |
+ arg_tpm2_pin = r;
|
|
|
594167 |
+
|
|
|
594167 |
} else if ((val = startswith(option, "try-empty-password="))) {
|
|
|
594167 |
|
|
|
594167 |
r = parse_boolean(val);
|
|
|
594167 |
@@ -1301,7 +1312,7 @@ static int attach_luks_or_plain_or_bitlk_by_tpm2(
|
|
|
594167 |
key_file, arg_keyfile_size, arg_keyfile_offset,
|
|
|
594167 |
key_data, key_data_size,
|
|
|
594167 |
NULL, 0, /* we don't know the policy hash */
|
|
|
594167 |
- 0, /* PIN is currently unhandled in this case */
|
|
|
594167 |
+ arg_tpm2_pin,
|
|
|
594167 |
until,
|
|
|
594167 |
arg_headless,
|
|
|
594167 |
arg_ask_password_flags,
|