diff options
| author | Grigori Goronzy <greg@chown.ath.cx> | 2022-02-18 21:13:41 +0100 |
|---|---|---|
| committer | Grigori Goronzy <greg@chown.ath.cx> | 2022-03-15 21:17:00 +0100 |
| commit | 4005d41ef0d007021deb0536800fc782ff670420 (patch) | |
| tree | f661dd820a67cc68765d6e34816780805464206a /src | |
| parent | caeb5604f9fd8e7aa43c7a1c853f8a7597240b17 (diff) | |
| download | systemd-4005d41ef0d007021deb0536800fc782ff670420.tar.gz | |
cryptsetup: add manual TPM2 PIN configuration
Handle the case where TPM2 metadata is not available and explicitly
provided in crypttab. This adds a new "tpm2-pin" option to crypttab
options for this purpose.
Diffstat (limited to 'src')
| -rw-r--r-- | src/cryptsetup/cryptsetup.c | 13 |
1 files changed, 12 insertions, 1 deletions
diff --git a/src/cryptsetup/cryptsetup.c b/src/cryptsetup/cryptsetup.c index b03dc1a3ff..c2075f53fd 100644 --- a/src/cryptsetup/cryptsetup.c +++ b/src/cryptsetup/cryptsetup.c @@ -82,6 +82,7 @@ static char *arg_fido2_rp_id = NULL; static char *arg_tpm2_device = NULL; static bool arg_tpm2_device_auto = false; static uint32_t arg_tpm2_pcr_mask = UINT32_MAX; +static bool arg_tpm2_pin = false; static bool arg_headless = false; static usec_t arg_token_timeout_usec = 30*USEC_PER_SEC; @@ -387,6 +388,16 @@ static int parse_one_option(const char *option) { arg_tpm2_pcr_mask |= mask; } + } else if ((val = startswith(option, "tpm2-pin="))) { + + r = parse_boolean(val); + if (r < 0) { + log_error_errno(r, "Failed to parse %s, ignoring: %m", option); + return 0; + } + + arg_tpm2_pin = r; + } else if ((val = startswith(option, "try-empty-password="))) { r = parse_boolean(val); @@ -1301,7 +1312,7 @@ static int attach_luks_or_plain_or_bitlk_by_tpm2( key_file, arg_keyfile_size, arg_keyfile_offset, key_data, key_data_size, NULL, 0, /* we don't know the policy hash */ - 0, /* PIN is currently unhandled in this case */ + arg_tpm2_pin, until, arg_headless, arg_ask_password_flags, |