I want to load unlock my LUKS partition (root file system) at boot time using a TPM 2.0.

I've had no success using a keyscript=/path/to/script in my /etc/crypttab file, however I made progress using methods I found here.

I am using dracut to build initial ram fs images.

So in /usr/lib/dracut/modules.d/90crypt, I have made modifications to several files (according to the guide I linked):


# gives me access to these binaries at boot time in initramfs
function install() {
    # existing code
    # ...
    inst /sbin/tpm2_nvread
    inst /bin/tail
    inst /bin/perl
    inst /sbin/resourcemgr


resourcemgr &
# yum is only at tpm2-tools 1.1.0, so I can't read keys to a file
# this is my solution to grab from tpm, and convert the spaced out hex to binary
function gettpmkeyfile() {
    key=`tpm2_nvread -x 0x1500001 -a 0x40000001 -s 32 -o 0 | tail -n 1`
    key=`echo $key | /bin/perl -ne 's/([0-9a-f]{2})/print chr hex $1/gie'`
    printf $key
gettpmkeyfile | cryptsetup luksOpen $device $luksname --key-file=-



i know the binaries are loaded properly, and I've added the keys from the TPM with luksAddKey, and I've tested my function on the command line in a shell after booting with a passphrase.

The problem I have is that the tpm2_nvread is throwing an error about the resource manager failing to initialize (error 0x1).

I noticed however that in a normal bootup, the resource manager fails here too, but doesn't prevent me from using the tpm2-tools commands.

I've tried upgrading to the latest kernel from elrepo (4.something), and I've added kernel drievrs with dracut like so:

dracut --add-drivers tpm_crb --force

This doesn't seem to help.

Any advice on how I can get tpm2_nvread to work in the initrd?


I found a solution!

I added /sbin/strace to my installed binaries in module-setup.sh so i could manually inspect the tpm2_nvread command in the dracut shell. Turns out the error was that my network was unreachable.

The tpm2 commands uses libtcti to communicate with the tpm, which uses a socket at

Now, as far as why the loopback was down, I'm not sure. My guess is either 90crypt in dracut runs before networking is available, or something to do with the fact that I disabled systemd.

So I added /sbin/ifup to module-setup.sh, and added this to my cryptroot-ask.sh:

ifup lo inet loopback
sleep 3

Not sure if I need the sleep but I put it anyways.


You could also add "-T device" to your tpm2_nvread so that it talks directly to /dev/tpm0 without needing to go through the resource manager.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.