How can I execute tpm2_nvread in the initramfs image created by dracut for centOS 7?

Question

I want to load unlock my LUKS partition (root file system) at boot time using a TPM 2.0.

I've had no success using a keyscript=/path/to/script in my /etc/crypttab file, however I made progress using methods I found here.

I am using dracut to build initial ram fs images.

So in /usr/lib/dracut/modules.d/90crypt, I have made modifications to several files (according to the guide I linked):

module-setup.sh

# gives me access to these binaries at boot time in initramfs
function install() {
    # existing code
    # ...
    inst /sbin/tpm2_nvread
    inst /bin/tail
    inst /bin/perl
    inst /sbin/resourcemgr
}

cryptroot-ask.sh

resourcemgr &
# yum is only at tpm2-tools 1.1.0, so I can't read keys to a file
# this is my solution to grab from tpm, and convert the spaced out hex to binary
function gettpmkeyfile() {
    key=`tpm2_nvread -x 0x1500001 -a 0x40000001 -s 32 -o 0 | tail -n 1`
    key=${key//[[:blank:]]/}
    key=`echo $key | /bin/perl -ne 's/([0-9a-f]{2})/print chr hex $1/gie'`
    printf $key
}
gettpmkeyfile | cryptsetup luksOpen $device $luksname --key-file=-

/etc/dracut.conf

omit_dracutmodules+="systemd"
add_dracutmodules+="crypt"

i know the binaries are loaded properly, and I've added the keys from the TPM with luksAddKey, and I've tested my function on the command line in a shell after booting with a passphrase.

The problem I have is that the tpm2_nvread is throwing an error about the resource manager failing to initialize (error 0x1).

I noticed however that in a normal bootup, the resource manager fails here too, but doesn't prevent me from using the tpm2-tools commands.

I've tried upgrading to the latest kernel from elrepo (4.something), and I've added kernel drievrs with dracut like so:

dracut --add-drivers tpm_crb --force

This doesn't seem to help.

Any advice on how I can get tpm2_nvread to work in the initrd?

Answer 1

I found a solution!

I added /sbin/strace to my installed binaries in module-setup.sh so i could manually inspect the tpm2_nvread command in the dracut shell. Turns out the error was that my network was unreachable.

The tpm2 commands uses libtcti to communicate with the tpm, which uses a socket at 127.0.0.1:2323.

Now, as far as why the loopback was down, I'm not sure. My guess is either 90crypt in dracut runs before networking is available, or something to do with the fact that I disabled systemd.

So I added /sbin/ifup to module-setup.sh, and added this to my cryptroot-ask.sh:

ifup lo inet loopback
sleep 3

Not sure if I need the sleep but I put it anyways.

Answer 2

You could also add "-T device" to your tpm2_nvread so that it talks directly to /dev/tpm0 without needing to go through the resource manager.