Bug 1989321
| Summary: | tpm2_createprimary fails | |||
|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 9 | Reporter: | Colin Walters <walters> | |
| Component: | tpm2-tss | Assignee: | Štěpán Horáček <shoracek> | |
| Status: | CLOSED WONTFIX | QA Contact: | Vilém Maršík <vmarsik> | |
| Severity: | high | Docs Contact: | ||
| Priority: | unspecified | |||
| Version: | CentOS Stream | CC: | bhu, bstinson, dbohanno, dustymabe, jlebon, jsnitsel, jwboyer, miabbott, rvr, travier | |
| Target Milestone: | beta | Keywords: | Triaged | |
| Target Release: | --- | |||
| Hardware: | Unspecified | |||
| OS: | Linux | |||
| Whiteboard: | ||||
| Fixed In Version: | Doc Type: | If docs needed, set a value | ||
| Doc Text: | Story Points: | --- | ||
| Clone Of: | ||||
| : | 2008179 (view as bug list) | Environment: | ||
| Last Closed: | 2023-02-03 07:27:45 UTC | Type: | Bug | |
| Regression: | --- | Mount Type: | --- | |
| Documentation: | --- | CRM: | ||
| Verified Versions: | Category: | --- | ||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
| Cloudforms Team: | --- | Target Upstream Version: | ||
| Embargoed: | ||||
| Bug Depends On: | ||||
| Bug Blocks: | 1958021, 1988161 | |||
|
Description
Colin Walters
2021-08-03 00:07:20 UTC
This is also affecting Fedora CoreOS rawhide too now. It's breaking any test which uses TPM2:
```
$ clevis luks bind -f -k /tmp/ignition-luks-1495034653 -d /run/ignition/dev_aliases/dev/disk/by-partlabel/varlog sss '{"pins":{"tpm2":{}},"t":1}'
Warning: Value 512 is outside of the allowed entropy range, adjusting it.
ERROR:esys_crypto:src/tss2-esys/esys_crypto_ossl.c:327:iesys_cryptossl_hmac_start() ErrorCode (0x00070001) EVP_PKEY_new_mac_key
ERROR:esys_crypto:src/tss2-esys/esys_crypto.c:185:iesys_crypto_authHmac() Error ErrorCode (0x00070001)
ERROR:esys:src/tss2-esys/esys_iutil.c:1244:iesys_compute_hmac() HMAC error ErrorCode (0x00070001)
ERROR:esys:src/tss2-esys/esys_iutil.c:1354:iesys_gen_auths() Error while computing hmacs ErrorCode (0x00070001)
ERROR:esys:src/tss2-esys/api/Esys_CreatePrimary.c:244:Esys_CreatePrimary_Async() Error in computation of auth values ErrorCode (0x00070001)
ERROR:esys:src/tss2-esys/api/Esys_CreatePrimary.c:110:Esys_CreatePrimary() Error in async function ErrorCode (0x00070001)
ERROR: Esys_CreatePrimary(0x70001) - esapi:Catch all for all errors not otherwise specified
ERROR: Unable to run tpm2_createprimary
Creating TPM2 primary key failed!
Invalid input!
Usage: jose jwe fmt -i JWE [-I CT] [-o JWE] [-O CT] [-c]
Converts a JWE between serialization formats
...
Failed to import token from file.
Error saving metadata to LUKS2 header in device /run/ignition/dev_aliases/dev/disk/by-partlabel/varlog
Unable to update metadata; operation cancelled
Error adding new binding to /run/ignition/dev_aliases/dev/disk/by-partlabel/varlog
```
Started happening with tpm2-tss-3.1.0-4.fc36, which was rebuilt for OpenSSL 3.0.0. So based on that and the stderr, I agree with Colin this is likely an OpenSSL-related issue.
Moving to tpm2-tss since it seems like the error actually lies in libtss2.
Wasn't sure if you preferred we cloned this to Fedora rawhide or you'd rather keep it all in this RHBZ. Can do the clone if you'd like.
I'm raising the severity as this will prevent us from shipping RHEL 9 in RHCOS. Is this still an issue with the latest builds? With tpm2-tss-3.0.3-6.el9 and tpm2-tools-5.0-7.el9 trying tpm2_createprimary works for me in a guest running RHEL-9.0.0-20211019.d.8-x86_64-dvd1.iso. After evaluating this issue, there are no plans to address it further or fix it in an upcoming release. Therefore, it is being closed. If plans change such that this issue will be fixed in an upcoming release, then the bug can be reopened. (In reply to Jerry Snitselaar from comment #5) > Is this still an issue with the latest builds? With tpm2-tss-3.0.3-6.el9 and > tpm2-tools-5.0-7.el9 trying tpm2_createprimary works for me in a guest > running RHEL-9.0.0-20211019.d.8-x86_64-dvd1.iso. I think the answer is that it's not still a problem: https://github.com/openshift/os/issues/605#issuecomment-1421978827 The needinfo request[s] on this closed bug have been removed as they have been unresolved for 120 days |