Allow sysadm access to TPM #2952
Merged
+2
−0
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Fixes:
$ sudo clevis luks bind -d /dev/vda3 tpm2 "{}"
# systemd-cryptenroll --tpm2-device=auto /dev/vda3
type=PROCTITLE msg=audit(11/11/2025 06:34:49.586:82) : proctitle=systemd-cryptenroll --tpm2-device=auto /dev/vda3
type=SYSCALL msg=audit(11/11/2025 06:34:49.586:82) : arch=x86_64 syscall=add_key success=no exit=EINVAL(Invalid argument) a0=0x7f05bd4e0b77 a1=0x5617881a6395 a2=0x56178887db00 a3=0x0 items=0 ppid=2318 pid=2904 auid=dcd uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=pts0 ses=1 comm=systemd-crypten exe=/usr/bin/systemd-cryptenroll subj=staff_u:sysadm_r:sysadm_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(11/11/2025 06:34:49.586:82) : avc: denied { write } for pid=2904 comm=systemd-crypten scontext=staff_u:sysadm_r:sysadm_t:s0-s0:c0.c1023 tcontext=system_u:system_r:kernel_t:s0 tclass=key permissive=1
type=PROCTITLE msg=audit(11/01/2025 22:30:19.534:717) : proctitle=/usr/bin/bash -e /bin/clevis-decrypt-tpm2
type=PATH msg=audit(11/01/2025 22:30:19.534:717) : item=0 name=/dev/tpmrm0 inode=102 dev=00:05 mode=character,660 ouid=tss ogid=tss rdev=fd:10000 obj=system_u:object_r:tpm_device_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0
type=CWD msg=audit(11/01/2025 22:30:19.534:717) : cwd=/home/dcd
type=SYSCALL msg=audit(11/01/2025 22:30:19.534:717) : arch=x86_64 syscall=faccessat2 success=no exit=EACCES(Permission denied) a0=AT_FDCWD a1=0x55fa435f4ab0 a2=R_OK a3=0x200 items=1 ppid=2207 pid=2212 auid=dcd uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=tty1 ses=1 comm=clevis-decrypt- exe=/usr/bin/bash subj=staff_u:sysadm_r:sysadm_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(11/01/2025 22:30:19.534:717) : avc: denied { read } for pid=2212 comm=clevis-decrypt- name=tpmrm0 dev="devtmpfs" ino=102 scontext=staff_u:sysadm_r:sysadm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:tpm_device_t:s0 tclass=chr_file permissive=0
https://issues.redhat.com/browse/RHEL-119055
Signed-off-by: Vit Mojzis <[email protected]>
Contributor
|
Merging, thank you. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixes:
$ sudo clevis luks bind -d /dev/vda3 tpm2 "{}"
systemd-cryptenroll --tpm2-device=auto /dev/vda3
type=PROCTITLE msg=audit(11/11/2025 06:34:49.586:82) : proctitle=systemd-cryptenroll --tpm2-device=auto /dev/vda3
type=SYSCALL msg=audit(11/11/2025 06:34:49.586:82) : arch=x86_64 syscall=add_key success=no exit=EINVAL(Invalid argument) a0=0x7f05bd4e0b77 a1=0x5617881a6395 a2=0x56178887db00 a3=0x0 items=0 ppid=2318 pid=2904 auid=dcd uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=pts0 ses=1 comm=systemd-crypten exe=/usr/bin/systemd-cryptenroll subj=staff_u:sysadm_r:sysadm_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(11/11/2025 06:34:49.586:82) : avc: denied { write } for pid=2904 comm=systemd-crypten scontext=staff_u:sysadm_r:sysadm_t:s0-s0:c0.c1023 tcontext=system_u:system_r:kernel_t:s0 tclass=key permissive=1
type=PROCTITLE msg=audit(11/01/2025 22:30:19.534:717) : proctitle=/usr/bin/bash -e /bin/clevis-decrypt-tpm2
type=PATH msg=audit(11/01/2025 22:30:19.534:717) : item=0 name=/dev/tpmrm0 inode=102 dev=00:05 mode=character,660 ouid=tss ogid=tss rdev=fd:10000 obj=system_u:object_r:tpm_device_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0
type=CWD msg=audit(11/01/2025 22:30:19.534:717) : cwd=/home/dcd
type=SYSCALL msg=audit(11/01/2025 22:30:19.534:717) : arch=x86_64 syscall=faccessat2 success=no exit=EACCES(Permission denied) a0=AT_FDCWD a1=0x55fa435f4ab0 a2=R_OK a3=0x200 items=1 ppid=2207 pid=2212 auid=dcd uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=tty1 ses=1 comm=clevis-decrypt- exe=/usr/bin/bash subj=staff_u:sysadm_r:sysadm_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(11/01/2025 22:30:19.534:717) : avc: denied { read } for pid=2212 comm=clevis-decrypt- name=tpmrm0 dev="devtmpfs" ino=102 scontext=staff_u:sysadm_r:sysadm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:tpm_device_t:s0 tclass=chr_file permissive=0
https://issues.redhat.com/browse/RHEL-119055