[tpm2] Re: Error on TPM2 and Ubuntu 19.04

[tpm2] Re: Error on TPM2 and Ubuntu 19.04

[Tadeusz Struk]

[-- Attachment #1: Type: text/plain, Size: 1209 bytes --]

On 10/15/19 11:56 AM, Trey Weaver wrote:
> /*tpm2_createprimary -V -H o -g sha256 -G ecc -C primary2.ctx*//*
> */
> /*ObjectAttribute: 0x00030072*//*
> */
> /*ERROR on line: "182" in file: "tools/tpm2_createprimary.c":*//*
> */
> /*CreatePrimary Failed ! ErrorCode: 0x9a2*/

0x9a2 error means that the authorization failed. Seems like there is a
auth (password) setup for the owner hierarchy and by default clevis and
tpm2_createprimary use an empty auth. You can change the auth to an
empty one:

$ tpm2_changeauth -c o -p <OLD_PASS> ""

("") -means empty pass

and after that both the tpm2_createprimary and clevis encrypt tpm2
should work with the default.

> I am sure I have TPM2 setup correctly because things like tpm2_getrandom
> work fine.

tpm2_getrandom tool doesn't use the owner hierarchy thus it doesn't need
any authorization.

> 
> tpm2_createprimary is version 3.1.3
> 
> What can I do? 
> Is there another tool beside clevis to auto unlock my drive that works
> better?
> Is there such a thing as a matched pair of tpm2-tool and clevis that I
> can get a package for? 

I would follow what the clevis says. It looks like it requires tools v3
--
Tadeusz

[tpm2] Re: Error on TPM2 and Ubuntu 19.04

[Oliver, Dario N]

[-- Attachment #1: Type: text/plain, Size: 1632 bytes --]

Hello Trey,

I made Clevis work in Ubuntu 18.04 some time ago, this are my steps to get everything installed and working (with /dev/sdb1 as example):

	sudo apt install clevis clevis-luks clevis-tpm2
	cryptsetup -y -v luksFormat /dev/sdb1
	clevis luks bind -d /dev/sdb1 tpm2 '{"pcr_bank":"sha256","pcr_ids":"0,1,2,3,4,5,6,7"}'
	clevis luks unlock -d /dev/sdb1 -n c1
	mkfs.ext4 /dev/mapper/c1
	mount /dev/mapper/c1 /home/encrypted	

you can customize the PCR Policy configuration (remove it, or select a subset of the PCRS but no more than 8, otherwise you can run into this https://github.com/tpm2-software/tpm2-tools/issues/1632)

The clevis-tpm2 package is needed. And it will install tpm2-tools as a dependency.
You should not need the tpm2-abrmd component, given that this works with the /dev/tpmrm0 resource manager.

I had some problems making this work in Ubuntu 18.04, explained here https://github.com/latchset/clevis/issues/106, but should work in 19.04

You can use the tpm2_rc_decode tool to get a little more information about the error code 0x9a2

	tpm2_rc_decode 0x9a2
	
	error layer
		hex: 0x0
		identifier: TSS2_TPM_RC_LAYER
		description: Error produced by the TPM
	format 1 error code
		hex: 0x22
		identifier: TPM2_RC_BAD_AUTH
		description: authorization failure without DA implications
	session:
		hex: 0x100
		identifier: TPM2_RC_1
		description: (null)

Whenever I run into this 0x9a2 issue, it is a problem with the TPM, not the tools. 
My "solution" is to go into the BIOS, and clear the TPM. This will delete everything stored in it. Be careful!

Hope this helps!

[tpm2] Re: Error on TPM2 and Ubuntu 19.04

[Steven Clark]

[-- Attachment #1: Type: text/plain, Size: 420 bytes --]

I don't know anywhere near enough about your setup to safely answer that.
I think using the TPM with disk encryption is still uncommon in end user
Linux systems.  If you're prompted for a password there's a good chance the
TPM is not used by your drive encryption but it's still possible.  If you
run a list persistent and there's no handles that makes it much more likely
the TPM was just locked before shipping.

[-- Attachment #2: attachment.html --]
[-- Type: text/html, Size: 460 bytes --]