Re: [isar-cip-core][PATCH] encrypt_partition: evict stale systemd SRK handle before enrollment

Jan Kiszka
2026-04-16T16:03:19Z

On 16.04.26 16:56, Quirin Gylstorff wrote:
>
>
> On 4/16/26 4:30 PM, Jan Kiszka wrote:
>> On 06.04.26 15:39, Sari, Sercan wrote:
>>> systemd-cryptenroll persists its TPM2 SRK at handle 0x81000001
>>
>> Is that handle number officially documented? Or was it retrieved from
>> the code?
>>
>>> evict any stale handle before enrollment to avoid
>>> "Failed to seal to TPM2: State not recoverable".
>
> Could you also write when this error occurs.
>

But then we would parse an error string and re-run the cryptenroll -
does not sound very appealing this way.

Jan

--
Siemens AG, Foundational Technologies
Linux Expert Center