[SOLVED] no matter how many times I enroll the secure boot keys to TPM dracut asks for my password | Arch Linux Community | Page 1

marble tartan Mar 31, 2025, 10:12 AM

#

So I have an encrypted root volume on /dev/nvme0n1p2, and I have enrolled the decryption keys into the tpm with systemd-cryptenroll.
After regenerating the initramfs, Dracut still asks for the password for the rootfs

how can I get it to use the keys on the tpm
or did I enroll the keys wrong?

untold isleBOT Mar 31, 2025, 10:13 AM

#

.aw luks

south whaleBOT Mar 31, 2025, 10:13 AM

#

untold isle .aw luks

LUKS

https://wiki.archlinux.org/title/LUKS

opaque marlin Mar 31, 2025, 10:16 AM

#

marble tartan So I have an encrypted root volume on `/dev/nvme0n1p2`, and I have enrolled the ...

have you seen dis section? https://wiki.archlinux.org/title/Systemd-cryptenroll#Trusted_Platform_Module

Systemd-cryptenroll

untold isleBOT Mar 31, 2025, 10:16 AM

#

as specified here, I generated a recovery key, noted it down and enrolled the keys
https://wiki.archlinux.org/title/Dm-crypt/Encrypting_an_entire_system#LUKS_on_a_partition_with_TPM2_and_Secure_Boot

#

ya

OfficerK ↩️

[Reply to:](#1356209447134953712 message) have you seen dis section? https://wiki.archlinux.org/title/Systemd-cryptenroll#Trusted_Platform_Module … 📎

opaque marlin Mar 31, 2025, 10:16 AM

#

untold isle ya

did u add this?

untold isleBOT Mar 31, 2025, 10:17 AM

#

ya

#

[sparky@katie ~]$ run0 lsinitrd | grep tpm2-tss
tpm2-tss
-rw-r--r--   1 root     root           89 Oct 20 22:26 usr/lib/sysusers.d/tpm2-tss.conf
-rw-r--r--   1 root     root          592 Oct 20 22:26 usr/lib/tmpfiles.d/tpm2-tss-fapi.conf

#

tried setting the crypttab.initramfs

#

lemme check if it will work

#

it did not

#

it still asks for the password to decrypt rooffs

#

rootfs

#

The TPM will automatically release the key as long as the boot chain is not tampered with.

opaque marlin Mar 31, 2025, 10:28 AM

#

@marble tartan try to add systemd to your dracut modules

untold isleBOT Mar 31, 2025, 10:28 AM

#

hmm idk if my chain is tampered
how do I check :3

#

it's there

OfficerK ↩️

[Reply to:](#1356209447134953712 message) @marble tartan try to add systemd to your dracut modules

#

opaque marlin Mar 31, 2025, 10:29 AM

#

ah

untold isleBOT Mar 31, 2025, 10:30 AM

#

what do I do now :3

opaque marlin Mar 31, 2025, 10:30 AM

#

untold isle what do I do now :3

idk im searching for stuffs

#

if I find smthg I tell u

untold isleBOT Mar 31, 2025, 10:31 AM

#

would get myself a FIDO2 key
if they weren't as expensive as ₺3k

opaque marlin Mar 31, 2025, 10:31 AM

#

😔

untold isleBOT Mar 31, 2025, 10:32 AM

#

keeping the key in an USB, plugging it and then unplugging it is among the options

#

(I'm thinking aloud you might ignore me)

opaque marlin Mar 31, 2025, 10:41 AM

#

@marble tartan there's this but

#

also was reading this

#

https://www.reddit.com/r/archlinux/comments/v83q1i/systemd_tpm2_decryption_keeps_asking_for_luks/

From the archlinux community on Reddit

Explore this post and more from the archlinux community

opaque marlin Mar 31, 2025, 10:42 AM

#

opaque marlin https://www.reddit.com/r/archlinux/comments/v83q1i/systemd_tpm2_decryption_keeps...

I think you can do it while booted?

untold isleBOT Mar 31, 2025, 10:42 AM

#

it is not booted tho
it is between booted and not booted

opaque marlin Mar 31, 2025, 10:42 AM

#

#

by specifying a different name? idk

opaque marlin Mar 31, 2025, 10:43 AM

#

untold isle it is not booted tho it is between booted and not booted

wdym

untold isleBOT Mar 31, 2025, 10:43 AM

#

when the initramfs requests the root volume key

opaque marlin Mar 31, 2025, 10:44 AM

#

yeah I meant after you boot

#

to test it

#

using the command above

untold isleBOT Mar 31, 2025, 10:44 AM

#

Cannot use device /dev/nvme0n1p2 which is in use (already mapped or mounted).

#

hmm

opaque marlin Mar 31, 2025, 10:44 AM

#

opaque marlin

read dis comment

untold isleBOT Mar 31, 2025, 10:44 AM

#

i'll try a live usb

#

TPM2 operation failed, falling back to traditional unlocking: Device or resource busy

#

opaque marlin Mar 31, 2025, 10:46 AM

#

untold isle

is root the mapping name you use?

untold isleBOT Mar 31, 2025, 10:46 AM

#

ya

opaque marlin Mar 31, 2025, 10:46 AM

#

untold isle ya

yeah so read the comment on reddit

#

I think if you specify a different name u might be able to test it even while booted?

#

im not sure

untold isleBOT Mar 31, 2025, 10:47 AM

#

i tried

#

that did not work either

opaque marlin Mar 31, 2025, 10:47 AM

#

ah

#

hmm

untold isleBOT Mar 31, 2025, 10:50 AM

#

On live system this throws "operation not permitted" errors

#

Failed to unseal secret using TPM2: Operation not permitted

#

Found a bug report but that was marked as fixed

opaque marlin Mar 31, 2025, 10:57 AM

#

untold isle Found a bug report but that was marked as fixed

idk tbh

untold isleBOT Mar 31, 2025, 11:01 AM

#

:3

opaque marlin Mar 31, 2025, 11:03 AM

#

@marble tartan https://bbs.archlinux.org/viewtopic.php?id=293760

#

actually the error is a bit different

#

idk

marble tartan Mar 31, 2025, 11:07 AM

#

clearing the tpm would revoke the secure boot keys

marble tartan Mar 31, 2025, 11:13 AM

#

opaque marlin idk

thank you anyway

deep emberBOT Mar 31, 2025, 11:13 AM

#

0fficerk received a thank you cookie!

opaque marlin Mar 31, 2025, 11:14 AM

#

marble tartan thank you anyway

Yw, sorry my knowledge on this is very limited 😔

marble tartan Mar 31, 2025, 11:14 AM

#

it's alright

#

ig i just find a sd card to decrypt (I have no sd card slots)

opaque marlin Mar 31, 2025, 11:14 AM

#

trollface

sacred hollow Mar 31, 2025, 2:32 PM

#

marble tartan So I have an encrypted root volume on `/dev/nvme0n1p2`, and I have enrolled the ...

what are the keys bound to?

#

the TPM usually binds to PCR 7, secure boot state, by default

untold isleBOT Mar 31, 2025, 2:32 PM

#

elaborate

#

theyre bound to that

Fleuria ↩️

[Reply to:](#1356209447134953712 message) the TPM usually binds to PCR 7, secure boot state, by default

sacred hollow Mar 31, 2025, 2:33 PM

#

did you change anything about your secure boot keys, or turned it on or off?

#

oh, wait

#

hang on

sacred hollow Mar 31, 2025, 2:35 PM

#

untold isle On live system this throws "operation not permitted" errors

is this an Ubuntu live ISO?

untold isleBOT Mar 31, 2025, 2:35 PM

#

i did

#

arch live iso

Fleuria ↩️

[Reply to:](#1356209447134953712 message) is this an Ubuntu live ISO?

sacred hollow Mar 31, 2025, 2:35 PM

#

or otherwise any live ISO which provides secure boot support by default

#

oh, hm

#

oh, archlive

untold isleBOT Mar 31, 2025, 2:36 PM

#

mhm

sacred hollow Mar 31, 2025, 2:36 PM

#

did you sign it with your own keys, or did it just work?

untold isleBOT Mar 31, 2025, 2:36 PM

#

it worked because of ventoy ig

sacred hollow Mar 31, 2025, 2:36 PM

#

oh, and…

#

did you sign ventoy?

untold isleBOT Mar 31, 2025, 2:37 PM

#

ya

sacred hollow Mar 31, 2025, 2:37 PM

#

hm, interesting…

untold isleBOT Mar 31, 2025, 2:37 PM

#

also enrolled the ventoy keys

sacred hollow Mar 31, 2025, 2:38 PM

#

so, my hunch is that something in the boot process you used involved shim

#

because shim measures its own keys to PCR 7, and hence would make a shim-booted system not able to unlock your drive

#

something you can try here is to re-enroll the TPM2, but this time not binding to any PCR registers at all

#

if it works then it’s probably shim or something else modifying PCR 7

untold isleBOT Mar 31, 2025, 2:39 PM

#

i dont see shim

#

if shim was somewhat enrolled it should have probably existed in the efibootmgr output

#

shouldnt it

sacred hollow Mar 31, 2025, 2:39 PM

#

not necessarily

#

it’s a live usb right?

#

that uses the fallback boot path

#

I’m also talking specifically about the failure in the live environment, not with the main system

untold isleBOT Mar 31, 2025, 2:40 PM

#

mhm

#

idk

sacred hollow Mar 31, 2025, 2:40 PM

#

though as for the main system, my one question would be what kernel parameters you are using

untold isleBOT Mar 31, 2025, 2:40 PM

#

~> cat /proc/cmdline
BOOT_IMAGE=/vmlinuz-linux-cachyos root=UUID=d3a547f3-8f66-4507-abf9-519ff8c99fe7 rw rootflags=subvol=@ loglevel=3

sacred hollow Mar 31, 2025, 2:41 PM

#

ah!

#

that’s what happened

#

it doesn’t know to use a TPM by default

#

you need to tell systemd-cryptsetup explicitly that a TPM is to be used

untold isleBOT Mar 31, 2025, 2:41 PM

#

but crypttab.initramfs

sacred hollow Mar 31, 2025, 2:42 PM

#

dracut does not include crypttab.initramfs

#

unless you specified it manually with the --include flag

untold isleBOT Mar 31, 2025, 2:42 PM

#

mhm

#

on one side I am compiling stuff on a different machine so if I disappear I am probably fixing that machine

sacred hollow Mar 31, 2025, 2:43 PM

#

anyway, you can bsdtar out the initramfs file you have

#

to see if there’s even a crypttab file in there

untold isleBOT Mar 31, 2025, 2:44 PM

#

there is none

sacred hollow Mar 31, 2025, 2:44 PM

#

as to be expected…

#

so, the quickest fix you can try to apply here

untold isleBOT Mar 31, 2025, 2:44 PM

#

im including it

sacred hollow Mar 31, 2025, 2:44 PM

#

okay

#

make sure it’s only named /etc/crypttab in the initramfs

#

the .initramfs thing is a mkinitcpio extension

untold isleBOT Mar 31, 2025, 2:45 PM

#

aaa

#

how

sacred hollow Mar 31, 2025, 2:45 PM

#

the --include flag allows you to rename the file to be included

untold isleBOT Mar 31, 2025, 2:45 PM

#

i recall something like that from dracut(8)

sacred hollow Mar 31, 2025, 2:45 PM

#

dracut is very weird in this regard because the --include flag can only be used once, for one file

#

everything else can only be added as the exact name and path they are in the main root

#

the other option is to forgo a crypttab

untold isleBOT Mar 31, 2025, 2:46 PM

#

mhm

sacred hollow Mar 31, 2025, 2:46 PM

#

since you’re already getting a password prompt in the first place systemd-gpt-auto-generator seems to be doing its job

#

so you can just add rd.luks.options=[LUKS block UUID]=tpm2-device=auto

#

the UUID there is for the LUKS block, not for the filesystem inside

untold isleBOT Mar 31, 2025, 2:49 PM

#

the uuid for nvme0n1p2

sacred hollow Mar 31, 2025, 2:49 PM

#

yea, that works

untold isleBOT Mar 31, 2025, 2:50 PM

#

i set that

sacred hollow Mar 31, 2025, 2:52 PM

#

then you can try it!

untold isleBOT Mar 31, 2025, 2:53 PM

#

didnt work

#

BOOT_IMAGE=/vmlinuz-linux-cachyos root=UUID=d3a547f3-8f66-4507-abf9-519ff8c99fe7 rw rootflags=subvol=@ rd.luks.options=UUID=ff47b26b-0cd8-4510-b662-f04df75e9ba1=tpm2-device=auto loglevel=

#

loglevel is 3

sacred hollow Mar 31, 2025, 2:54 PM

#

no need to add the UUID= there

untold isleBOT Mar 31, 2025, 2:55 PM

#

mhm

sacred hollow Mar 31, 2025, 2:55 PM

#

https://wiki.archlinux.org/title/Dm-crypt/System_configuration#rd.luks.options see this for an example

System configuration

#

oh, wait

#

I didn’t realise you could just omit the UUID

#

I skimmed through the man page but the Arch Wiki says you can just not specify anything and it’ll apply to all devices

untold isleBOT Mar 31, 2025, 2:56 PM

#

let's see

sacred hollow Mar 31, 2025, 2:56 PM

#

If only a list of options, without a UUID, is specified, they apply to any UUIDs not specified elsewhere, and without an entry in /etc/crypttab.

#

if this doesn’t work then it should no longer be a configuration issue but a TPM issue

#

in which case my next suggestion would be to try and enroll a new key not bound to any PCR registers at all

sacred hollow Mar 31, 2025, 2:57 PM

#

sacred hollow in which case my next suggestion would be to try and enroll a new key not bound ...

if this doesn’t work then the TPM is probably busted

#

if it does work then something about PCR 7 on your motherboard might be borked, or it might have changed when you didn’t look

untold isleBOT Mar 31, 2025, 2:58 PM

#

the tpm boots just fine tho

sacred hollow Mar 31, 2025, 2:58 PM

#

I’m just laying out future hypotheticals

#

what matters right now is just the current step, which is to try again with the correct parameter

untold isleBOT Mar 31, 2025, 3:03 PM

#

did not work

sacred hollow Mar 31, 2025, 3:04 PM

#

did it say anything before dropping you into the password prompt?

#

like if it had anything about a TPM error

untold isleBOT Mar 31, 2025, 3:07 PM

#

nope

sacred hollow Mar 31, 2025, 3:07 PM

#

okay, well

#

as I said, if you still want to try and troubleshoot this, my next suggestion is to wipe the current TPM2 key slot, and replace it with one that isn’t bound to anything

#

for this, add --tpm2-pcrs='' when enrolling the new TPM slot

untold isleBOT Mar 31, 2025, 3:11 PM

#

~> run0 systemd-cryptenroll --wipe-slot 2
Wiping requested and no block device node specified, refusing.

#

im stupid

#

i did it

#

the tpm slot was 2

sacred hollow Mar 31, 2025, 3:12 PM

#

yup, you just forgot to specify the disk at the end

#

which is a mistake I still make too

untold isleBOT Mar 31, 2025, 3:13 PM

#

ya wiped it

#

on one side I am compiling a window manager

#

so well I might be slow to respond

#

do I enroll again now

Fleuria ↩️

[Reply to:](#1356209447134953712 message) for this, add --tpm2-pcrs='' when enrolling the new TPM slot

sacred hollow Mar 31, 2025, 3:13 PM

#

yea!

#

you can then try and open it in a live USB again

#

if it works then you could try booting the main system

#

since it’s not bound to anything it should really just work this time

#

if it doesn’t then this is a Cursed Hardware Issue that is beyond my capacity to help

deep emberBOT Mar 31, 2025, 3:15 PM

#

fleuriafluoride received a thank you cookie!

untold isleBOT Mar 31, 2025, 3:15 PM

#

thank you so much @sacred hollow

sacred hollow Mar 31, 2025, 3:15 PM

#

of course!

#

you can tell me how it goes once you try unlocking it

untold isleBOT Mar 31, 2025, 3:25 PM

#

On live usb it unlocks

#

On machine it does not

sacred hollow Mar 31, 2025, 3:27 PM

#

then it seems something is still wrong with the configuration for your initramfs…

#

since this is cachyos, did it make a crypttab in the main root?

untold isleBOT Mar 31, 2025, 3:28 PM

#

ya

#

an empty one

#

well the cachyos installer failed to finish so I just installed the rest of the system myself

sacred hollow Mar 31, 2025, 3:28 PM

#

hm…

#

well, we could try to explicitly instruct systemd-cryptsetup-generator using kernel parameters as in here

System configuration

#

though we already tried that once and it didn’t turn out too well…

untold isleBOT Mar 31, 2025, 3:30 PM

#

mkinitcpio

sacred hollow Mar 31, 2025, 3:30 PM

#

oh, sure, use mkinitcpio

untold isleBOT Mar 31, 2025, 3:30 PM

#

i use dracut, not mkinitcpio

sacred hollow Mar 31, 2025, 3:30 PM

#

oh

#

I misinterpreted

#

well, the kernel parameters should still work since they’re supposed to be for systemd, not dracut or mkinitcpio in particular

#

but if it doesn’t we can try to embed a crypttab into the initramfs

#

if you want to use the /etc/crypttab.initramfs name for this, then you have to find whatever script is running dracut and then add --include /etc/crypttab.initramfs /etc/crypttab to the list of options

untold isleBOT Mar 31, 2025, 3:33 PM

#

what if I embed the key into the initrd

sacred hollow Mar 31, 2025, 3:33 PM

#

you can do that, too!

untold isleBOT Mar 31, 2025, 3:33 PM

#

it's a bit dangerous

#

but nobody that could possibly gain physical access to my machine would be computer literate enough to comprehend that

#

how do I proceed now

sacred hollow Mar 31, 2025, 3:38 PM

#

well, you can just create a keyfile in the default location

#

in your case this would be something like /etc/cryptsetup-keys.d/root.key

#

and you can add a dracut configuration file to have dracut add it to your initramfs

#

ideally systemd-gpt-auto-generator and systemd-cryptsetup-generator will work together to automatically use it to unlock your root partition

#

if not… I guess dracut would be really weird

untold isleBOT Mar 31, 2025, 3:46 PM

#

oki

#

i will check

#

But I have to setup another machine now

limpid swan Mar 31, 2025, 5:11 PM

#

@marble tartan why use tpm?

untold isleBOT Mar 31, 2025, 5:12 PM

#

because I do not want to enter my password every time to the obnoxious prompt

#

and no I wont use plymouth

#

setting up plymouth is another nightmare

#

and I dont have a card reader either

untold isleBOT Apr 1, 2025, 10:57 AM

#

alright this is what happens when I install the keys to the initrd

dracut-install: ERROR: installing '/etc/cryptsetup.keys.d/root.key'
dracut[E]: FAILED: /usr/lib/dracut/dracut-install -D /var/tmp/dracut.9mSnen/initramfs -a /etc/cryptsetup.keys.d/root.key

#

install_items+=" /etc/cryptsetup.keys.d/root.key "

this is my miserable config file

sacred hollow Apr 1, 2025, 11:01 AM

#

untold isle ``` install_items+=" /etc/cryptsetup.keys.d/root.key " ``` this is my miserable...

did you misspell the name? it should be cryptsetup-keys.d not cryptsetup.keys.d

untold isleBOT Apr 1, 2025, 11:02 AM

#

oops

#

fixed that

#

now I add a crypttab to the initrd right?

sacred hollow Apr 1, 2025, 11:07 AM

#

you don’t need to, hopefully

#

it’s named root.key so it will automatically be used for /dev/mapper/root

#

and systemd-gpt-auto-generator will automatically name the decrypted root device root

#

but if you reboot and this doesn’t work, you can add a crypttab or rd.luks options

untold isleBOT Apr 1, 2025, 11:11 AM

#

that did not work so I added luks options

Fleuria ↩️

[Reply to:](#1356209447134953712 message) it’s named root.key so it will automatically be used for /dev/mapper/root

sacred hollow Apr 1, 2025, 11:12 AM

#

okay, sure

#

wait…

#

I might have forgot this whole time

#

dracut adds options to your initramfs automatically without asking!

untold isleBOT Apr 1, 2025, 11:13 AM

#

wdym

sacred hollow Apr 1, 2025, 11:13 AM

#

it will automatically detect command line options

#

and put it into the initramfs

#

and that has probably been screwing over systemd’s automatic systems this whole time

untold isleBOT Apr 1, 2025, 11:14 AM

#

so do I now uhh

#

remove the rd prefix

#

or do I remove the cmdline altogether

sacred hollow Apr 1, 2025, 11:14 AM

#

you don’t need to since you will only decrypt the device in the initramfs

#

there’s an option for no hostonly cmdline

#

that will prevent dracut from adding options

#

you can check the man page to see how it’s spelled

untold isleBOT Apr 1, 2025, 11:17 AM

#

regenerated the initramfs

#

rebooting

untold isleBOT Apr 1, 2025, 11:35 AM

#

it did not work

sacred hollow Apr 1, 2025, 4:08 PM

#

okay, this is very late but my question would then be if you’re actually using systemd-gpt-auto-generator

#

that was another assumption I was making that could be wrong

untold isleBOT Apr 1, 2025, 5:13 PM

#

well how do I check

Fleuria ↩️

[Reply to:](#1356209447134953712 message) okay, this is very late but my question would then be if you’re actually using systemd-gpt-auto-gene…

sacred hollow Apr 1, 2025, 5:14 PM

#

do you have any root= parameters in your command line?

untold isleBOT Apr 1, 2025, 5:15 PM

#

ya

#

read-write mount of the open luks volume

sacred hollow Apr 1, 2025, 5:23 PM

#

and do you have parameters that specify the LUKS volume?

untold isleBOT Apr 1, 2025, 5:54 PM

#

wdym

Fleuria ↩️

[Reply to:](#1356209447134953712 message) and do you have parameters that specify the LUKS volume?

sacred hollow Apr 1, 2025, 6:01 PM

#

like, did you add the rd.luks parameters that specified name and UUID and stuff per the Arch Wiki?

untold isleBOT Apr 1, 2025, 7:49 PM

#

yes

Fleuria ↩️

[Reply to:](#1356209447134953712 message) like, did you add the rd.luks parameters that specified name and UUID and stuff per the Arch Wiki?

sacred hollow Apr 1, 2025, 7:50 PM

#

in that case, the only thing left to do is to add the parameter explicitly describing the location of the keyfile too

#

and if somehow, after all of that, it still doesn’t work

#

then this is a Cursed Problem and I would recommend trying mkinitcpio

untold isleBOT Apr 1, 2025, 7:51 PM

#

oki ty

#

(I tried that too, that one did not work either)

Fleuria ↩️

[Reply to:](#1356209447134953712 message) in that case, the only thing left to do is to add the parameter explicitly describing the location o…

sacred hollow Apr 1, 2025, 7:51 PM

#

like I have a mkinitcpio initramfs with all the systemd bells and whistles

#

and the stuff I’ve done with crypto stuff all worked first try

untold isleBOT Apr 1, 2025, 7:57 PM

#

so I give mkinitcpio another chance

Fleuria ↩️

[Reply to:](#1356209447134953712 message) and the stuff I’ve done with crypto stuff all worked first try

untold isleBOT Apr 2, 2025, 6:22 PM

#

mkinitcpio worked, apparently

#

how do I get rid of dracut now

#

thank you all @sacred hollow, @opaque marlin and @limpid swan

deep emberBOT Apr 2, 2025, 6:26 PM

#

fleuriafluoride, 0fficerk, and killertofus received a thank you cookie!

opaque marlin Apr 2, 2025, 6:27 PM

#

untold isle thank you all <@937024868518596629>, <@262144046804369408> and <@456226577798135...

yw :)

opaque marlin Apr 2, 2025, 6:27 PM

#

untold isle how do I get rid of dracut now

just uninstall the package ig?

untold isleBOT Apr 2, 2025, 6:33 PM

#

nope I cannot

#

also yay sbctl cannot sign grub now

#

haha

marble tartan Apr 2, 2025, 7:15 PM

#

[SOLVED] no matter how many times I enroll the secure boot keys to TPM dracut asks for my password

#[SOLVED] no matter how many times I enroll the secure boot keys to TPM dracut asks for my password