Add TPM 1.2 support by oldium · Pull Request #462 · latchset/clevis

oldium · 2024-05-05T21:34:49Z

This patch series adds TPM 1.2 support and fixes few other things (I can split this into multiple Pull Requests if you wish):

Added missing shutdown SystemD dependencies when using DefaultDependencies=no.
When Dracut without SystemD is used, benefit cryptsetup unlocking workflow to let it handle the crypttab and other options. This uses pipe to unlock with password similarly like the initramfs-tools image does. See commit message for more details.
Added full support for TPM 1.2.

Status:

[✅ Done] Clevis encrypt, decrypt, bind support
[✅ Done] initramfs-tools support
[✅ Done] Systemd support
[✅ Done] Manual page for clevis-encrypt-tpm1
[✅ Done] Tests for tpm1 pin
[✅ Done] Dracut support

Example usage:

Boot and unlock with TPM1.2:
clevis luks bind -d /dev/<device> tpm1 '{"pcr_ids":"0,4,7"}'
Encrypt and decrypt:
echo test | clevis encrypt tpm1 '{"pcr_ids":"0,4,7"}' | clevis decrypt

Tested:

Tested with initramfs-tools, used both TPM 1.2 and null pins with "fail":true to test success and failed unlocking
Tested with Dracut with SystemD. Tested both success and failed cases
Tested with Dracut without SystemD (module was disabled). Tested both success and failed cases
Tested with Dracut without SystemD (module was disabled), with programmatically changed detection that null pin is a network pin. Tested that with rd.neednet the unlocking happens after network gets online.

Fixes: #84, #456

src/initramfs-tools/hooks/clevis.in

src/pins/tang/tests/tang-common-test-functions.in

src/luks/clevis-luks-tpm1-functions

src/luks/dracut/clevis-pin-tpm1/module-setup.sh.in

src/luks/dracut/clevis/clevis-luks-unlocker.in

src/initramfs-tools/scripts/local-top/clevis.in

src/luks/clevis-luks-common-functions.in

src/luks/dracut/clevis/clevis-password-unlocker.in

oldium · 2024-06-30T16:54:54Z

Work is done, pre-built packages for Debian 12 and amd64 arch are available here https://github.com/oldium/clevis/releases/tag/v20_tpm1

oldium · 2024-07-03T07:49:22Z

The CentOS test build image needs some love, the mirrorlist.centos.org site does not exist any more it seems.

oldium · 2024-07-03T20:48:39Z

Rebased to latest master to fix the build.

Signed-off-by: Oldřich Jedlička <oldium.pro@gmail.com>

This is a weak requirement, so when TCSD is missing, it does not influence the Clevis askpass service startup. Similarly if the TCSD startup fails, it does not affect the Clevis askpass service startup. Signed-off-by: Oldřich Jedlička <oldium.pro@gmail.com>

Signed-off-by: Oldřich Jedlička <oldium.pro@gmail.com>

The command fails in Docker or otherwise limited environments, so skip the test when it is not usable. Signed-off-by: Oldřich Jedlička <oldium.pro@gmail.com>

…oot) [code-review] Unnecessary keyword. Signed-off-by: Oldřich Jedlička <oldium.pro@gmail.com>

…oot) [code-review] Check return value. Signed-off-by: Oldřich Jedlička <oldium.pro@gmail.com>

[code-review] Check return value. Signed-off-by: Oldřich Jedlička <oldium.pro@gmail.com>

[code-review] Update wording. Signed-off-by: Oldřich Jedlička <oldium.pro@gmail.com>

[code-review] Unify the function signatures. Signed-off-by: Oldřich Jedlička <oldium.pro@gmail.com>

Add forgotten copyright header. Signed-off-by: Oldřich Jedlička <oldium.pro@gmail.com>

Fix PCR bank and sealing fail logic. Signed-off-by: Oldřich Jedlička <oldium.pro@gmail.com>

Add missing local variable declaration. Signed-off-by: Oldřich Jedlička <oldium.pro@gmail.com>

Fix PCR bank and sealing fail logic in test. Signed-off-by: Oldřich Jedlička <oldium.pro@gmail.com>

Fix usage of uninitialized ${orig} value. Also test exactly the string without having newlines added by echo. Signed-off-by: Oldřich Jedlička <oldium.pro@gmail.com>

aadnehovda · 2025-09-14T08:19:02Z

Would this play nicely together with #467? Anything missing? Great for proxmox ZFS root on older TPM 1.2 only hardware.

oldium · 2025-09-14T08:39:58Z

Would this play nicely together with #467? Anything missing? Great for proxmox ZFS root on older TPM 1.2 only hardware.

Hard to say without looking more into the ZFS support. I see some code duplication in the ZFS initramfs hook, it installs basically the same binaries as the regular clevis hook. It misses TPM1.2 completely (for obvious reasons).

From the brief look I was not able to tell how exactly the ZFS unlocking works, but if it uses the same clevis functionality to decrypt the password, it should (in theory) work.

Side note: I have rebased my patches and changed them according to code-review input plus few fixes more (also for easier packaging of the new file pin in Debian). I will send an update within a week or two after testing it.

oldium · 2025-09-14T08:52:11Z

Possibly there will be some startup changes necessary to line-up with the ZFS support, because the clevis initramfs local-top script just starts the tcsd (TPM1.2 daemon) only in case the tpm1 pin is detected by get_pid_device_pins function (again, I do not know how the ZFS integration works). For dracut startup I can imagine missing optional startup dependency on tcsd.

Anyway, nothing impossible to do.

Signed-off-by: Oldřich Jedlička <oldium.pro@gmail.com>

oldium · 2025-11-16T21:11:15Z

Added several fixup! commits ready to be rebased after code review (with git rebase --autosquash). It is ready to be read one-by-one, the commits are small and self-explanatory.

On top of the code-review fixes, I added the following:

Few additional safety checks and local variable declarations.
Fixed usage of uninitialized variable in tpm2/tpm1 test code (the test did not test what it should test for a looooooong time...).
Fixed new template and file pins to allow installation under Debian. Debian installs all Dracut scripts and uses check() function to determine if the pin is actually installed on the system.

On top of that, I created a new tpm1u8 version and published GPG signed packages in the public repository – see the Release Notes.

sarroutbi

LGTM. Thanks for your PR. @sergio-correia : A double opinion is welcome here

oldium · 2025-12-12T13:27:42Z

Just a kind reminder: Please do not merge without auto-squashing first (git rebase --autosquash), I would be sad to have the commit history in this state 😁. I would like to do it when the reviews are finished.

akostadinov · 2026-02-11T18:19:42Z

Who needs to approve this PR for merge?

sarroutbi · 2026-02-18T12:05:23Z

Who needs to approve this PR for merge?

Changes LGTM. Waiting for @sergio-correia to check if anything else is required (it seems all suggested nits were resolved)

github-advanced-security bot found potential problems May 5, 2024

View reviewed changes

src/initramfs-tools/hooks/clevis.in Fixed Show fixed Hide fixed

oldium force-pushed the feature/tpm1 branch 2 times, most recently from 556332d to 04d5e9f Compare May 5, 2024 22:09

github-advanced-security bot found potential problems May 5, 2024

View reviewed changes

src/pins/tang/tests/tang-common-test-functions.in Fixed Show fixed Hide fixed

oldium force-pushed the feature/tpm1 branch 4 times, most recently from 2c32eb7 to a7de265 Compare May 8, 2024 14:26

oldium force-pushed the feature/tpm1 branch from a7de265 to d0b6fdb Compare June 18, 2024 19:36

github-advanced-security bot found potential problems Jun 18, 2024

View reviewed changes

oldium force-pushed the feature/tpm1 branch from d0b6fdb to a13d426 Compare June 18, 2024 19:50

github-advanced-security bot found potential problems Jun 18, 2024

View reviewed changes

src/luks/dracut/clevis/clevis-luks-unlocker.in Fixed Show fixed Hide fixed

oldium force-pushed the feature/tpm1 branch 2 times, most recently from b4cc648 to e83e669 Compare June 23, 2024 12:20

github-advanced-security bot found potential problems Jun 23, 2024

View reviewed changes

oldium force-pushed the feature/tpm1 branch 3 times, most recently from dc1c5c3 to 40bfdf4 Compare June 23, 2024 13:46

oldium marked this pull request as ready for review June 23, 2024 14:08

oldium changed the title ~~[WIP] Add TPM 1.2 support~~ Add TPM 1.2 support Jun 23, 2024

oldium mentioned this pull request Jun 23, 2024

Dracut fails to boot with Clevis 20 #456

Open

oldium force-pushed the feature/tpm1 branch from 40bfdf4 to ad0d447 Compare June 23, 2024 14:51

oldium mentioned this pull request Jun 30, 2024

Dracut module issue detecting TANG for "rd.neednet" injection #468

Open

oldium force-pushed the feature/tpm1 branch 2 times, most recently from 000c78a to b79a306 Compare July 2, 2024 20:39

oldium mentioned this pull request Jul 2, 2024

TPM 1.2 chip not supported? A TPM2 device with the in-kernel resource manager is needed! #256

Closed

oldium force-pushed the feature/tpm1 branch from b79a306 to d56a4d5 Compare July 3, 2024 20:46

oldium added 19 commits September 7, 2025 13:16

tpm1: added TPM 1.2 (tpm1 pin) documentation

dddcebd

Signed-off-by: Oldřich Jedlička <oldium.pro@gmail.com>

initramfs: added TPM 1.2 support for initramfs-tools

0cf5ebb

Signed-off-by: Oldřich Jedlička <oldium.pro@gmail.com>

dracut: added TPM 1.2 support for Dracut

a029c61

Signed-off-by: Oldřich Jedlička <oldium.pro@gmail.com>

tpm1: allow testing tpm1 pin in CI build

91a7660

Signed-off-by: Oldřich Jedlička <oldium.pro@gmail.com>

tpm2: added TPM 2 software TPM tests

8f88263

Signed-off-by: Oldřich Jedlička <oldium.pro@gmail.com>

initramfs: fix running on root-only readable initrd filesystem

990a1c8

Signed-off-by: Oldřich Jedlička <oldium.pro@gmail.com>

luks: check if keyutils are usable before running tests

1844166

The command fails in Docker or otherwise limited environments, so skip the test when it is not usable. Signed-off-by: Oldřich Jedlička <oldium.pro@gmail.com>

fixup! dracut: supply cryptsetup password through pipe (non-systemd b…

167e065

…oot) [code-review] Unnecessary keyword. Signed-off-by: Oldřich Jedlička <oldium.pro@gmail.com>

fixup! dracut: supply cryptsetup password through pipe (non-systemd b…

d9ed9a4

…oot) [code-review] Check return value. Signed-off-by: Oldřich Jedlička <oldium.pro@gmail.com>

fixup! initramfs: added TPM 1.2 support for initramfs-tools

f593f7d

[code-review] Check return value. Signed-off-by: Oldřich Jedlička <oldium.pro@gmail.com>

fixup! luks: allow reading used set of pins by clevis scripts

c3a9bf1

[code-review] Update wording. Signed-off-by: Oldřich Jedlička <oldium.pro@gmail.com>

fixup! initramfs: fix running on root-only readable initrd filesystem

6ead051

[code-review] Unify the function signatures. Signed-off-by: Oldřich Jedlička <oldium.pro@gmail.com>

fixup! initramfs: fix running on root-only readable initrd filesystem

bfdbad2

Add forgotten copyright header. Signed-off-by: Oldřich Jedlička <oldium.pro@gmail.com>

fixup! tpm1: added encrypt and decrypt support for TPM 1.2 as tpm1 pin

58c3ae6

Fix PCR bank and sealing fail logic. Signed-off-by: Oldřich Jedlička <oldium.pro@gmail.com>

fixup! initramfs: added TPM 1.2 support for initramfs-tools

f1c05ed

Add missing local variable declaration. Signed-off-by: Oldřich Jedlička <oldium.pro@gmail.com>

fixup! tpm1: added TPM 1.2 (tpm1 pin) tests

162e761

Fix PCR bank and sealing fail logic in test. Signed-off-by: Oldřich Jedlička <oldium.pro@gmail.com>

fixup! tpm1: added TPM 1.2 (tpm1 pin) tests

05af550

Fix usage of uninitialized ${orig} value. Also test exactly the string without having newlines added by echo. Signed-off-by: Oldřich Jedlička <oldium.pro@gmail.com>

tpm2: fix wrong expected value usage

c3ffe04

Fix usage of uninitialized ${orig} value. Also test exactly the string without having newlines added by echo. Signed-off-by: Oldřich Jedlička <oldium.pro@gmail.com>

almereyda mentioned this pull request Sep 14, 2025

Add support for ZFS encryption #467

Open

5 tasks

template: add precondition checks during installation into initrd

cc51c9e

Signed-off-by: Oldřich Jedlička <oldium.pro@gmail.com>

sarroutbi approved these changes Dec 12, 2025

View reviewed changes

oldium mentioned this pull request Dec 27, 2025

Use bash instead of sh for clevis-luks-unlocker #533

Open

Conversation

oldium commented May 5, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

oldium commented Jun 30, 2024

Uh oh!

oldium commented Jul 3, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

oldium commented Jul 3, 2024

Uh oh!

aadnehovda commented Sep 14, 2025

Uh oh!

oldium commented Sep 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

oldium commented Sep 14, 2025

Uh oh!

oldium commented Nov 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sarroutbi left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

oldium commented Dec 12, 2025

Uh oh!

akostadinov commented Feb 11, 2026

Uh oh!

sarroutbi commented Feb 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

oldium commented May 5, 2024 •

edited

Loading

oldium commented Jul 3, 2024 •

edited

Loading

oldium commented Sep 14, 2025 •

edited

Loading

oldium commented Nov 16, 2025 •

edited

Loading

sarroutbi left a comment •

edited

Loading

sarroutbi commented Feb 18, 2026 •

edited

Loading