[Bug 1969375] Re: systemd-cryptenroll does not support TPM2 devices

[Lukas Märdian]

** Changed in: systemd (Ubuntu Jammy)
       Status: Triaged => In Progress

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to systemd in Ubuntu.
https://bugs.launchpad.net/bugs/1969375

Title:
  systemd-cryptenroll does not support TPM2 devices

Status in systemd package in Ubuntu:
  Triaged
Status in systemd source package in Jammy:
  In Progress
Status in systemd source package in Kinetic:
  Triaged

Bug description:
  [Impact]

   * TPM2/FIDO cannot be used to unlock luks encrpyted block devices
   * due to missing build-time support in systemd
   * Error message: "TPM2 not supported on this build."

  [Test Plan]

  # prepare test
  $ sudo apt install libtss2-rc0 # runtime dependency for TPM usage
  $ dd if=/dev/zero of=encrypted.img bs=1 count=0 seek=100M
  $ echo -n "s0s3cur3" | cryptsetup luksFormat encrypted.img -
  $ sudo /usr/lib/systemd/systemd-cryptsetup attach volume encrypted.img
  🔐 Please enter passphrase for disk volume: s0s3cure
  Set cipher aes, mode xts-plain64, key size 512 bits for device encrypted.img.
  $ sudo mkfs.ext4 /dev/mapper/volume
  $ sudo mount /dev/mapper/volume /mnt
  $ sudo touch /mnt/TPM_TEST
  $ ls -la /mnt
  drwxr-xr-x  3 root root  4096 Jun  7 15:06 .
  drwxr-xr-x 20 root root  4096 Apr 20 11:45 ..
  drwx------  2 root root 16384 Jun  7 15:06 lost+found
  -rw-r--r--  1 root root     0 Jun  7 15:06 TPM_TEST
  $ sudo umount /dev/mapper/volume
  $ sudo cryptsetup luksClose volume
  $ ls -la /mnt # empty

  # use TPM
  $ systemd-cryptenroll --tpm2-device=list
  PATH        DEVICE      DRIVER
  /dev/tpmrm0 MSFT0101:00 tpm_tis
  $ sudo systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=7 encrypted.img
  🔐 Please enter current passphrase for disk /home/lukas/canonical/systemd-dbg/encrypted.img: s0s3cur3
  New TPM2 token enrolled as key slot 1.
  $ sudo /usr/lib/systemd/systemd-cryptsetup attach volume encrypted.img - tpm2-device=auto
  Set cipher aes, mode xts-plain64, key size 512 bits for device encrypted.img.
  Automatically discovered security TPM2 token unlocks volume.
  # no password needed above!
  $ sudo mount /dev/mapper/volume /mnt
  $ ls -la /mnt
  drwxr-xr-x  3 root root  4096 Jun  7 15:06 .
  drwxr-xr-x 20 root root  4096 Apr 20 11:45 ..
  drwx------  2 root root 16384 Jun  7 15:06 lost+found
  -rw-r--r--  1 root root     0 Jun  7 15:06 TPM_TEST

  #cleanup
  $ sudo umount /dev/mapper/volume
  $ sudo cryptsetup luksClose volume
  $ ls -la /mnt # empty
  $ sudo rm encrypted.img

  [Where problems could occur]

   * we're enabling a build-flag to allow usage of TPM/FIDO hardware
   * running new code paths in systemd due to enablement of a new feature, could trigger hidden bugs in systemd-cryptsetup, e.g. (un-)locking for encrypted devices
   * new functionality is only active/used if enabled explicitly and suggested runtime dependencies are manually installed

  [Other Info]

   * This is not necessarily fall under the HWE SRU policy, as the TPM is already there, but just can't be used via systemd-cryptencroll
   * In a discussion with the SRU team (@vorlon) we agreed that this should be an exception to the rule, due to low regression risk. As long as it would not pull in extra dependencies into the default installation, which it doesn't (new dependencies are only "Suggests:")
   * This will be enabled in Kinetic+ as soon as we merge systemd v251 from Debian: https://salsa.debian.org/systemd-team/systemd/-/commit/6b5e99f1d7f63c0c83007de9f98f7745f4a564f8

  === original description ===

  systemd-cryptenroll can make use of tpm2 modules to bind against
  secure boot pcrs and enable auto unlocking of luks devices.

  Following the instructions here:
  https://wiki.archlinux.org/title/Trusted_Platform_Module#systemd-cryptenroll

  the following commands fail on ubuntu jammy (5.15.0-25-generic)

  root at testbox:~# systemd-cryptenroll --tpm2-device=list
  TPM2 not supported on this build.
  root at testbox:~# systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=7 /dev/sda3
  🔐 Please enter current passphrase for disk /dev/sda3: ***************
  root at testbox:~# echo $?
  1

  It appears that this issue has been resolved in the debian build for
  systemd here:  https://salsa.debian.org/systemd-
  team/systemd/-/commit/6b5e99f1d7f63c0c83007de9f98f7745f4a564f8

  Can we get the same modifications to the Jammy systemd build?

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/1969375/+subscriptions