Add TPM 1.2 support by oldium · Pull Request #462 · latchset/clevis

oldium · 2024-05-05T21:34:49Z

This patch series adds TPM 1.2 support and fixes few other things (I can split this into multiple Pull Requests if you wish):

Added missing shutdown SystemD dependencies when using DefaultDependencies=no.
When Dracut without SystemD is used, benefit cryptsetup unlocking workflow to let it handle the crypttab and other options. This uses pipe to unlock with password similarly like the initramfs-tools image does. See commit message for more details.
Added full support for TPM 1.2.

Status:

[✅ Done] Clevis encrypt, decrypt, bind support
[✅ Done] initramfs-tools support
[✅ Done] Systemd support
[✅ Done] Manual page for clevis-encrypt-tpm1
[✅ Done] Tests for tpm1 pin
[✅ Done] Dracut support

Example usage:

Boot and unlock with TPM1.2:
clevis luks bind -d /dev/<device> tpm1 '{"pcr_ids":"0,4,7"}'
Encrypt and decrypt:
echo test | clevis encrypt tpm1 '{"pcr_ids":"0,4,7"}' | clevis decrypt

Tested:

Tested with initramfs-tools, used both TPM 1.2 and null pins with "fail":true to test success and failed unlocking
Tested with Dracut with SystemD. Tested both success and failed cases
Tested with Dracut without SystemD (module was disabled). Tested both success and failed cases
Tested with Dracut without SystemD (module was disabled), with programmatically changed detection that null pin is a network pin. Tested that with rd.neednet the unlocking happens after network gets online.

Fixes: #84, #456

oldium · 2024-06-30T16:54:54Z

Work is done, pre-built packages for Debian 12 and amd64 arch are available here https://github.com/oldium/clevis/releases/tag/v20_tpm1

oldium · 2024-07-03T07:49:22Z

The CentOS test build image needs some love, the mirrorlist.centos.org site does not exist any more it seems.

oldium · 2024-07-03T20:48:39Z

Rebased to latest master to fix the build.

Signed-off-by: Oldřich Jedlička <oldium.pro@gmail.com>

The command fails in Docker or otherwise limited environments, so skip the test when it is not usable. Signed-off-by: Oldřich Jedlička <oldium.pro@gmail.com>

…oot) [code-review] Unnecessary keyword. Signed-off-by: Oldřich Jedlička <oldium.pro@gmail.com>

…oot) [code-review] Check return value. Signed-off-by: Oldřich Jedlička <oldium.pro@gmail.com>

[code-review] Check return value. Signed-off-by: Oldřich Jedlička <oldium.pro@gmail.com>

[code-review] Update wording. Signed-off-by: Oldřich Jedlička <oldium.pro@gmail.com>

[code-review] Unify the function signatures. Signed-off-by: Oldřich Jedlička <oldium.pro@gmail.com>

Add forgotten copyright header. Signed-off-by: Oldřich Jedlička <oldium.pro@gmail.com>

Fix PCR bank and sealing fail logic. Signed-off-by: Oldřich Jedlička <oldium.pro@gmail.com>

Add missing local variable declaration. Signed-off-by: Oldřich Jedlička <oldium.pro@gmail.com>

Fix PCR bank and sealing fail logic in test. Signed-off-by: Oldřich Jedlička <oldium.pro@gmail.com>

Fix usage of uninitialized ${orig} value. Also test exactly the string without having newlines added by echo. Signed-off-by: Oldřich Jedlička <oldium.pro@gmail.com>

aadnehovda · 2025-09-14T08:19:02Z

Would this play nicely together with #467? Anything missing? Great for proxmox ZFS root on older TPM 1.2 only hardware.

oldium · 2025-09-14T08:39:58Z

Would this play nicely together with #467? Anything missing? Great for proxmox ZFS root on older TPM 1.2 only hardware.

Hard to say without looking more into the ZFS support. I see some code duplication in the ZFS initramfs hook, it installs basically the same binaries as the regular clevis hook. It misses TPM1.2 completely (for obvious reasons).

From the brief look I was not able to tell how exactly the ZFS unlocking works, but if it uses the same clevis functionality to decrypt the password, it should (in theory) work.

Side note: I have rebased my patches and changed them according to code-review input plus few fixes more (also for easier packaging of the new file pin in Debian). I will send an update within a week or two after testing it.

oldium · 2025-09-14T08:52:11Z

Possibly there will be some startup changes necessary to line-up with the ZFS support, because the clevis initramfs local-top script just starts the tcsd (TPM1.2 daemon) only in case the tpm1 pin is detected by get_pid_device_pins function (again, I do not know how the ZFS integration works). For dracut startup I can imagine missing optional startup dependency on tcsd.

Anyway, nothing impossible to do.

Signed-off-by: Oldřich Jedlička <oldium.pro@gmail.com>

oldium · 2025-11-16T21:11:15Z

Added several fixup! commits ready to be rebased after code review (with git rebase --autosquash). It is ready to be read one-by-one, the commits are small and self-explanatory.

On top of the code-review fixes, I added the following:

Few additional safety checks and local variable declarations.
Fixed usage of uninitialized variable in tpm2/tpm1 test code (the test did not test what it should test for a looooooong time...).
Fixed new template and file pins to allow installation under Debian. Debian installs all Dracut scripts and uses check() function to determine if the pin is actually installed on the system.

On top of that, I created a new tpm1u8 version and published GPG signed packages in the public repository – see the Release Notes.

sarroutbi

LGTM. Thanks for your PR. @sergio-correia : A double opinion is welcome here

oldium · 2025-12-12T13:27:42Z

Just a kind reminder: Please do not merge without auto-squashing first (git rebase --autosquash), I would be sad to have the commit history in this state 😁. I would like to do it when the reviews are finished.

akostadinov · 2026-02-11T18:19:42Z

Who needs to approve this PR for merge?

sarroutbi · 2026-02-18T12:05:23Z

Who needs to approve this PR for merge?

Changes LGTM. Waiting for @sergio-correia to check if anything else is required (it seems all suggested nits were resolved)

oldium · 2026-04-14T11:10:24Z

[Updated]

@sarroutbi I am testing the rebase and almost everything works. Unfortunately, the newest Ubuntu 26.04 is using Dracut 110, which renumbered the systemd-cryptsetup module from 11 to 71, so we cannot add “needs” for cryptsetup.target, which is installed after clevis (we were 60, currently 50). The Dracut change breaks actually all versions of clevis-dracut - I am talking about this line, we do not depend on systemd-cryptsetup intentionally to allow installation without systemd. So either we switch some code to 90-99 range (not recommended for general use, but for adding one “needs” it would suffice), or create a bug report in Dracut repo, or think about a different solution...

Hm, or maybe I am wrong. Dracut has 00systemd, which installs cryptsetup.target. Let me check more...

[Edit]
00systemd is not installed - it is in old dracut repo, not dracut-ng...

sergio-correia

@oldium: Thanks, I finally had a chance to review this again. Looks very nice, but I pointed a few small issues to fix. Please, also rebase on top of the current master. Also, are you going to autosquash those fixup commits?

sergio-correia · 2026-04-14T14:08:52Z

+
+    copy_exec "${tcsd_bin}" || die 1 "Unable to copy ${tcsd_bin}"
+    copy_exec "${libgcc_s}" || die 1 "Unable to copy ${libgcc_s}"
+    copy_file config /etc/tcsd.conf || dia 2 "Unable to copy /etc/tcsd.conf"


Typo here: should be die instead of dia

sergio-correia · 2026-04-14T14:09:33Z

+    echo "root:x:0:0:root:/root:/bin/bash" >> "${DESTDIR}/etc/passwd"
+    echo "root:x:0:" >> "${DESTDIR}/etc/group"
+
+    group_id=`id -G tss` || die 2 "Unable to get tss group ID"


Isn't this supposed to be id -g (lowercase), to return all groups instead of primary GID?

The id -G is actually returning all groups, so this might form an invalid entry (not usually the case, tss is a system user created during package installation with single group tss). This usage is specifically about the group ID of the tss group, so getting it through the primary group of tss user is the way to go - id -g tss should be used.

sergio-correia · 2026-04-14T14:12:23Z

+            [ -f "/sys/class/tpm/tpm0/pcr-${_pcr_bank}/${_pcr}" ] || return 1
+        done
+    else
+        local pcr_args="${pcr_ids:+-p}${pcr_ids//,/ -p}"


I believe we should use $_pcrs (which we define in this validate_pcrs() function) here; we are using the "outer" $pcr_ids instead, whihc seems to work by coincidence.

sergio-correia · 2026-04-14T14:14:17Z

+        if ! ps -A -o pid | awk -v pid="${pid}" '$1==pid {found=1} END {exit !found}'; then
+            error "Failed waiting, ${name:process} terminated"
+        elif [ "${elapsed}" -gt "${max_timeout_in_s}" ]; then
+            error "Timeout (${max_timeout_in_s}s) waiting for ${name:process}"


${name:process} should be ${name:-process} (missing the dash for the default value), in those two instances here.

sergio-correia · 2026-04-14T14:15:27Z

+int
+setgid(gid_t gid)
+{
+    static int (*real_setgid)(uid_t) = NULL;


gid_t instead of uid_t here.

sergio-correia · 2026-04-14T14:18:07Z

+        }
+        return real_setgid(gid);
+    }
+    return 0;


This return is unreachable, please just remove it.

sergio-correia · 2026-04-14T14:19:55Z

+
+    local enc
+    if ! enc=$(echo -n "${orig}" | clevis encrypt tpm1 "${cfg}"); then
+        echo "${TEST}: encrypt failed for cfg: ${cfg}" >&1


This should probably be >&2

Actually, a copy-paste from tpm2 pin test 🙈 Fixing it there too.

oldium · 2026-04-14T14:30:06Z

Thanks @sergio-correia for the review, I now feel like a kid. I saw the code so many times and have not noticed that 😅. I will fix all your findings and auto-squash it.

oldium · 2026-04-14T17:12:53Z

The issue with Dracut 110 is reported here #545

guilherme-puida · 2026-04-15T14:44:23Z

I commented this in #545 as well, but clevis 20-1ubuntu2 was uploaded with a patch that fixes the ordering issue.

oldium · 2026-04-16T22:18:53Z

I will rebase onto #549 to create a non-conflicting branch.

github-advanced-security AI found potential problems May 5, 2024

View reviewed changes

Comment thread src/initramfs-tools/hooks/clevis.in Fixed

oldium force-pushed the feature/tpm1 branch 2 times, most recently from 556332d to 04d5e9f Compare May 5, 2024 22:09

github-advanced-security AI found potential problems May 5, 2024

View reviewed changes

Comment thread src/pins/tang/tests/tang-common-test-functions.in Fixed

oldium force-pushed the feature/tpm1 branch 4 times, most recently from 2c32eb7 to a7de265 Compare May 8, 2024 14:26

oldium force-pushed the feature/tpm1 branch from a7de265 to d0b6fdb Compare June 18, 2024 19:36

github-advanced-security AI found potential problems Jun 18, 2024

View reviewed changes

oldium force-pushed the feature/tpm1 branch from d0b6fdb to a13d426 Compare June 18, 2024 19:50

github-advanced-security AI found potential problems Jun 18, 2024

View reviewed changes

Comment thread src/luks/dracut/clevis/clevis-luks-unlocker.in Fixed

oldium force-pushed the feature/tpm1 branch 2 times, most recently from b4cc648 to e83e669 Compare June 23, 2024 12:20

github-advanced-security AI found potential problems Jun 23, 2024

View reviewed changes

oldium force-pushed the feature/tpm1 branch 3 times, most recently from dc1c5c3 to 40bfdf4 Compare June 23, 2024 13:46

oldium marked this pull request as ready for review June 23, 2024 14:08

oldium changed the title ~~[WIP] Add TPM 1.2 support~~ Add TPM 1.2 support Jun 23, 2024

oldium mentioned this pull request Jun 23, 2024

Dracut fails to boot with Clevis 20 #456

Open

oldium force-pushed the feature/tpm1 branch from 40bfdf4 to ad0d447 Compare June 23, 2024 14:51

oldium mentioned this pull request Jun 30, 2024

Dracut module issue detecting TANG for "rd.neednet" injection #468

Open

oldium force-pushed the feature/tpm1 branch 2 times, most recently from 000c78a to b79a306 Compare July 2, 2024 20:39

oldium mentioned this pull request Jul 2, 2024

TPM 1.2 chip not supported? A TPM2 device with the in-kernel resource manager is needed! #256

Closed

oldium force-pushed the feature/tpm1 branch from b79a306 to d56a4d5 Compare July 3, 2024 20:46

oldium added 13 commits September 7, 2025 13:16

initramfs: fix running on root-only readable initrd filesystem

990a1c8

Signed-off-by: Oldřich Jedlička <oldium.pro@gmail.com>

luks: check if keyutils are usable before running tests

1844166

The command fails in Docker or otherwise limited environments, so skip the test when it is not usable. Signed-off-by: Oldřich Jedlička <oldium.pro@gmail.com>

fixup! dracut: supply cryptsetup password through pipe (non-systemd b…

167e065

…oot) [code-review] Unnecessary keyword. Signed-off-by: Oldřich Jedlička <oldium.pro@gmail.com>

fixup! dracut: supply cryptsetup password through pipe (non-systemd b…

d9ed9a4

…oot) [code-review] Check return value. Signed-off-by: Oldřich Jedlička <oldium.pro@gmail.com>

fixup! initramfs: added TPM 1.2 support for initramfs-tools

f593f7d

[code-review] Check return value. Signed-off-by: Oldřich Jedlička <oldium.pro@gmail.com>

fixup! luks: allow reading used set of pins by clevis scripts

c3a9bf1

[code-review] Update wording. Signed-off-by: Oldřich Jedlička <oldium.pro@gmail.com>

fixup! initramfs: fix running on root-only readable initrd filesystem

6ead051

[code-review] Unify the function signatures. Signed-off-by: Oldřich Jedlička <oldium.pro@gmail.com>

fixup! initramfs: fix running on root-only readable initrd filesystem

bfdbad2

Add forgotten copyright header. Signed-off-by: Oldřich Jedlička <oldium.pro@gmail.com>

fixup! tpm1: added encrypt and decrypt support for TPM 1.2 as tpm1 pin

58c3ae6

Fix PCR bank and sealing fail logic. Signed-off-by: Oldřich Jedlička <oldium.pro@gmail.com>

fixup! initramfs: added TPM 1.2 support for initramfs-tools

f1c05ed

Add missing local variable declaration. Signed-off-by: Oldřich Jedlička <oldium.pro@gmail.com>

fixup! tpm1: added TPM 1.2 (tpm1 pin) tests

162e761

Fix PCR bank and sealing fail logic in test. Signed-off-by: Oldřich Jedlička <oldium.pro@gmail.com>

fixup! tpm1: added TPM 1.2 (tpm1 pin) tests

05af550

Fix usage of uninitialized ${orig} value. Also test exactly the string without having newlines added by echo. Signed-off-by: Oldřich Jedlička <oldium.pro@gmail.com>

tpm2: fix wrong expected value usage

c3ffe04

Fix usage of uninitialized ${orig} value. Also test exactly the string without having newlines added by echo. Signed-off-by: Oldřich Jedlička <oldium.pro@gmail.com>

almereyda mentioned this pull request Sep 14, 2025

Add support for ZFS encryption #467

Open

5 tasks

template: add precondition checks during installation into initrd

cc51c9e

Signed-off-by: Oldřich Jedlička <oldium.pro@gmail.com>

sarroutbi approved these changes Dec 12, 2025

View reviewed changes

oldium mentioned this pull request Dec 27, 2025

Use bash instead of sh for clevis-luks-unlocker #533

Open

sergio-correia requested changes Apr 14, 2026

View reviewed changes

Conversation

oldium commented May 5, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

oldium commented Jun 30, 2024

Uh oh!

oldium commented Jul 3, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

oldium commented Jul 3, 2024

Uh oh!

aadnehovda commented Sep 14, 2025

Uh oh!

oldium commented Sep 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

oldium commented Sep 14, 2025

Uh oh!

oldium commented Nov 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sarroutbi left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

oldium commented Dec 12, 2025

Uh oh!

akostadinov commented Feb 11, 2026

Uh oh!

sarroutbi commented Feb 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

oldium commented Apr 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sergio-correia left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

oldium commented Apr 14, 2026

oldium commented May 5, 2024 •

edited

Loading

oldium commented Jul 3, 2024 •

edited

Loading

oldium commented Sep 14, 2025 •

edited

Loading

oldium commented Nov 16, 2025 •

edited

Loading

sarroutbi left a comment •

edited

Loading

sarroutbi commented Feb 18, 2026 •

edited

Loading

oldium commented Apr 14, 2026 •

edited

Loading

oldium commented Apr 14, 2026 •

edited

Loading