I want to load unlock my LUKS partition (root file system) at boot time using a TPM 2.0.
I've had no success using a keyscript=/path/to/script
in my /etc/crypttab
file, however I made progress using methods I found here.
I am using dracut to build initial ram fs images.
So in /usr/lib/dracut/modules.d/90crypt
, I have made modifications to several files (according to the guide I linked):
module-setup.sh
# gives me access to these binaries at boot time in initramfs
function install() {
# existing code
# ...
inst /sbin/tpm2_nvread
inst /bin/tail
inst /bin/perl
inst /sbin/resourcemgr
}
cryptroot-ask.sh
resourcemgr &
# yum is only at tpm2-tools 1.1.0, so I can't read keys to a file
# this is my solution to grab from tpm, and convert the spaced out hex to binary
function gettpmkeyfile() {
key=`tpm2_nvread -x 0x1500001 -a 0x40000001 -s 32 -o 0 | tail -n 1`
key=${key//[[:blank:]]/}
key=`echo $key | /bin/perl -ne 's/([0-9a-f]{2})/print chr hex $1/gie'`
printf $key
}
gettpmkeyfile | cryptsetup luksOpen $device $luksname --key-file=-
/etc/dracut.conf
omit_dracutmodules+="systemd"
add_dracutmodules+="crypt"
i know the binaries are loaded properly, and I've added the keys from the TPM with luksAddKey
, and I've tested my function on the command line in a shell after booting with a passphrase.
The problem I have is that the tpm2_nvread
is throwing an error about the resource manager failing to initialize (error 0x1
).
I noticed however that in a normal bootup, the resource manager fails here too, but doesn't prevent me from using the tpm2-tools
commands.
I've tried upgrading to the latest kernel from elrepo (4.something), and I've added kernel drievrs with dracut like so:
dracut --add-drivers tpm_crb --force
This doesn't seem to help.
Any advice on how I can get tpm2_nvread
to work in the initrd?