Re: [isar-cip-core][PATCH] encrypt_partition: evict stale systemd SRK handle before enrollment

Quirin Gylstorff
2026-04-16T14:56:37Z

On 4/16/26 4:30 PM, Jan Kiszka wrote:
> On 06.04.26 15:39, Sari, Sercan wrote:
>> systemd-cryptenroll persists its TPM2 SRK at handle 0x81000001
>
> Is that handle number officially documented? Or was it retrieved from
> the code?
>
>> evict any stale handle before enrollment to avoid
>> "Failed to seal to TPM2: State not recoverable".

Could you also write when this error occurs.

Quirin

>>
>> Signed-off-by: Sercan Sari <sari.sercan@siemens.com>
>> ---
>> .../files/encrypt_partition.systemd.script | 5 +++++
>> 1 file changed, 5 insertions(+)
>>
>> diff --git a/recipes-initramfs/initramfs-crypt-hook/files/encrypt_partition.systemd.script b/recipes-initramfs/initramfs-crypt-hook/files/encrypt_partition.systemd.script
>> index 1b7c83b..841219c 100644
>> --- a/recipes-initramfs/initramfs-crypt-hook/files/encrypt_partition.systemd.script
>> +++ b/recipes-initramfs/initramfs-crypt-hook/files/encrypt_partition.systemd.script
>> @@ -26,6 +26,11 @@ enroll_tpm2_token() {
>> #tpm_key_algorithm="$4"
>> #pcr_bank_hash_type="$5"
>>
>> + # systemd-cryptenroll persists its TPM2 SRK at handle 0x81000001
>> + # evict any stale handle before enrollment to avoid
>> + # "Failed to seal to TPM2: State not recoverable".
>> + tpm2_evictcontrol -C o -c 0x81000001 2>/dev/null || true
>
> "|| true" is always a bit fragile and bad for debugging. Can't we test
> for the handle first and actually fail if eviction is then not successful?
>
>> +
>> # check systemd version and export password if necessary
>> if [ -x /usr/bin/systemd-cryptenroll ]; then
>> systemd_version=$(systemd-cryptenroll --version | \
>
> Jan
>