[isar-cip-core][PATCH] encrypt_partition: evict stale systemd SRK handle before enrollment

Sari, Sercan
2026-04-06T23:18:24Z

systemd-cryptenroll persists its TPM2 SRK at handle 0x81000001
evict any stale handle before enrollment to avoid
"Failed to seal to TPM2: State not recoverable".

Signed-off-by: Sercan Sari <sari.sercan@siemens.com>
---
.../files/encrypt_partition.systemd.script | 5 +++++
1 file changed, 5 insertions(+)

diff --git a/recipes-initramfs/initramfs-crypt-hook/files/encrypt_partition.systemd.script b/recipes-initramfs/initramfs-crypt-hook/files/encrypt_partition.systemd.script
index 1b7c83b..841219c 100644
--- a/recipes-initramfs/initramfs-crypt-hook/files/encrypt_partition.systemd.script
+++ b/recipes-initramfs/initramfs-crypt-hook/files/encrypt_partition.systemd.script
@@ -26,6 +26,11 @@ enroll_tpm2_token() {
#tpm_key_algorithm="$4"
#pcr_bank_hash_type="$5"

+ # systemd-cryptenroll persists its TPM2 SRK at handle 0x81000001
+ # evict any stale handle before enrollment to avoid
+ # "Failed to seal to TPM2: State not recoverable".
+ tpm2_evictcontrol -C o -c 0x81000001 2>/dev/null || true
+
# check systemd version and export password if necessary
if [ -x /usr/bin/systemd-cryptenroll ]; then
systemd_version=$(systemd-cryptenroll --version | \
--
2.25.1