Re: [isar-cip-core][PATCH] encrypt_partition: evict stale systemd SRK handle before enrollment

sari.sercan
2026-04-17T07:49:44Z

[-- Attachment #1: Type: text/plain, Size: 1575 bytes --]

On Thu, Apr 16, 2026 at 05:30 PM, Jan Kiszka wrote:

>
> On 06.04.26 15:39, Sari, Sercan wrote:
>
>> systemd-cryptenroll persists its TPM2 SRK at handle 0x81000001
>
> Is that handle number officially documented? Or was it retrieved from
> the code?

Yes, officially documented in man page.

>
>
>> evict any stale handle before enrollment to avoid
>> "Failed to seal to TPM2: State not recoverable".
>>
>> Signed-off-by: Sercan Sari <sari.sercan@...>
>> ---
>> .../files/encrypt_partition.systemd.script | 5 +++++
>> 1 file changed, 5 insertions(+)
>>
>> diff --git
>> a/recipes-initramfs/initramfs-crypt-hook/files/encrypt_partition.systemd.script
>> b/recipes-initramfs/initramfs-crypt-hook/files/encrypt_partition.systemd.script
>>
>> index 1b7c83b..841219c 100644
>> ---
>> a/recipes-initramfs/initramfs-crypt-hook/files/encrypt_partition.systemd.script
>>
>> +++
>> b/recipes-initramfs/initramfs-crypt-hook/files/encrypt_partition.systemd.script
>>
>> @@ -26,6 +26,11 @@ enroll_tpm2_token() {
>> #tpm_key_algorithm="$4"
>> #pcr_bank_hash_type="$5"
>>
>> + # systemd-cryptenroll persists its TPM2 SRK at handle 0x81000001
>> + # evict any stale handle before enrollment to avoid
>> + # "Failed to seal to TPM2: State not recoverable".
>> + tpm2_evictcontrol -C o -c 0x81000001 2>/dev/null || true
>
> "|| true" is always a bit fragile and bad for debugging. Can't we test
> for the handle first and actually fail if eviction is then not successful?

Agreed, better to look at with tpm2_getcap first, then evict.

[-- Attachment #2: Type: text/html, Size: 1676 bytes --]