Merge pull request #30766 from polarina/cryptenroll-tpm2-unlock

[thirdparty/systemd.git] / man / systemd-cryptenroll.xml

diff --git a/man/systemd-cryptenroll.xml b/man/systemd-cryptenroll.xml
index e6bbe2be63ec3a4ca90955deb99c9d34ec3c3106..95f5a450b6d5a8436468f9cde3c3bea8ebaa70cc 100644 (file)
--- a/man/systemd-cryptenroll.xml
+++ b/man/systemd-cryptenroll.xml
@@ -222,10 +222,10 @@
     <title>Limitations</title>
 
     <para>Note that currently when enrolling a new key of one of the five supported types listed above, it is
-    required to first provide a passphrase, a recovery key or a FIDO2 token. It's currently not supported to
-    unlock a device with a TPM2/PKCS#11 key in order to enroll a new TPM2/PKCS#11 key. Thus, if in future key
-    roll-over is desired it's generally recommended to ensure a passphrase, a recovery key or a FIDO2 token
-    is always enrolled.</para>
+    required to first provide a passphrase, a recovery key, a FIDO2 token, or a TPM2 key. It's currently not
+    supported to unlock a device with a PKCS#11 key in order to enroll a new PKCS#11 key. Thus, if in future
+    key roll-over is desired it's generally recommended to ensure a passphrase, a recovery key, a FIDO2
+    token, or a TPM2 key is always enrolled.</para>
 
     <para>Also note that support for enrolling multiple FIDO2 tokens is currently limited. When multiple FIDO2
     tokens are enrolled, <command>systemd-cryptseup</command> will perform pre-flight requests to attempt to
@@ -310,6 +310,18 @@
         <xi:include href="version-info.xml" xpointer="v253"/></listitem>
       </varlistentry>
 
+      <varlistentry>
+        <term><option>--unlock-tpm2-device=</option><replaceable>PATH</replaceable></term>
+
+        <listitem><para>Use a TPM2 device insteaad of a password/passhprase read from stdin to unlock the
+        volume. Expects a device node path referring to the TPM2 chip (e.g. <filename>/dev/tpmrm0</filename>).
+        Alternatively the special value <literal>auto</literal> may be specified, in order to automatically
+        determine the device node of a currently discovered TPM2 device (of which there must be exactly one).
+        </para>
+
+        <xi:include href="version-info.xml" xpointer="v256"/></listitem>
+      </varlistentry>
+
       <varlistentry>
         <term><option>--pkcs11-token-uri=</option><replaceable>URI</replaceable></term>