Bug 2141380

Summary:	Move libcryptsetup-token-systemd-tpm2.so from 'devel' to 'udev' subpackage
Product:	Red Hat Enterprise Linux 9	Reporter:	Vitaly Kuznetsov <vkuznets>
Component:	systemd	Assignee:	systemd-maint
Status:	CLOSED DUPLICATE	QA Contact:	Frantisek Sumsal <fsumsal>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	9.2	CC:	andavis, berrange, dgilbert, dtardon, mmorsy, systemd-maint-list
Target Milestone:	rc	Keywords:	Bugfix, Reproducer, Triaged
Target Release:	---	Flags:	pm-rhel: mirror+
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-12-07 14:13:42 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Vitaly Kuznetsov 2022-11-09 16:38:33 UTC

systemd-cryptsetup volume unlock with a key sealed to TPM doesn't work by default:

# systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=0 /dev/vdb2
New TPM2 token enrolled as key slot 0.
# /usr/lib/systemd/systemd-cryptsetup attach encroot /dev/vdb2 - tpm2-device=/dev/tpm0
Set cipher aes, mode xts-plain64, key size 512 bits for device /dev/vdb2.
🔐 Please enter passphrase for disk encroot:

(no password request is expected at this point!)

and it isn't clear what's wrong. strace gives the answer:

2423  openat(AT_FDCWD, "/usr/lib64/cryptsetup/libcryptsetup-token-systemd-tpm2.so", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)

the plugin is found in 'devel' subpackage and after installing it everything works as expected:

# /usr/lib/systemd/systemd-cryptsetup attach encroot /dev/vdb2 - tpm2-device=/dev/tpm0
# (no password request)

This library, however, has nothing to do with 'development', it's a normal production thing. Please consider moving it from '-devel' to '-udev' (where /usr/lib/systemd/systemd-cryptsetup is currently located)

P.S. Fedora seems to package cryptsetup tokens correctly, i.e:
$ rpm -qpl systemd-udev-251.8-586.fc37.aarch64.rpm  | grep cryptsetup-token
/usr/lib64/cryptsetup/libcryptsetup-token-systemd-fido2.so
/usr/lib64/cryptsetup/libcryptsetup-token-systemd-pkcs11.so
/usr/lib64/cryptsetup/libcryptsetup-token-systemd-tpm2.so

Comment 1 David Tardon 2022-11-10 13:31:03 UTC

Ack, this is a clear packaging bug.

Comment 2 David Tardon 2022-12-07 14:13:42 UTC


*** This bug has been marked as a duplicate of bug 2074833 ***