cryptenroll,repart: print a log message if no access restrictions are applied to...

diff --git a/src/cryptenroll/cryptenroll.c b/src/cryptenroll/cryptenroll.c
index 101cc5f1dd1dad91e0c388f04172387eab6d4e44..8941d7a5ae89a5295dee7c33daf0e828a412ee74 100644 (file)
--- a/src/cryptenroll/cryptenroll.c
+++ b/src/cryptenroll/cryptenroll.c
@@ -697,6 +697,13 @@ static int parse_argv(int argc, char *argv[]) {
                         assert(arg_tpm2_public_key_pcr_mask == 0);
                         arg_tpm2_public_key_pcr_mask = INDEX_TO_MASK(uint32_t, TPM2_PCR_KERNEL_BOOT);
                 }
+
+                if (arg_tpm2_n_hash_pcr_values == 0 &&
+                    !arg_tpm2_pin &&
+                    arg_tpm2_public_key_pcr_mask == 0 &&
+                    !arg_tpm2_pcrlock)
+                        log_notice("Notice: enrolling TPM2 with an empty policy, i.e. without any state or access restrictions.\n"
+                                   "Use --tpm2-public-key=, --tpm2-pcrlock=, --tpm2-with-pin= or --tpm2-pcrs= to enable one or more restrictions.");
         }
 
         return 1;

diff --git a/src/repart/repart.c b/src/repart/repart.c
index 9f7d9c75d0a40cc645b81c722e61198be29b6ef3..05b9f6d437362f6349be380b34d5cb5ac721d66e 100644 (file)
--- a/src/repart/repart.c
+++ b/src/repart/repart.c
@@ -4597,6 +4597,12 @@ static int partition_encrypt(Context *context, Partition *p, PartitionTarget *ta
                 int keyslot;
                 TPM2Flags flags = 0;
 
+                if (arg_tpm2_n_hash_pcr_values == 0 &&
+                    arg_tpm2_public_key_pcr_mask == 0 &&
+                    !arg_tpm2_pcrlock)
+                        log_notice("Notice: encrypting future partition %" PRIu64 ", locking against TPM2 with an empty policy, i.e. without any state or access restrictions.\n"
+                                   "Use --tpm2-public-key=, --tpm2-pcrlock=, or --tpm2-pcrs= to enable one or more restrictions.", p->partno);
+
                 if (arg_tpm2_public_key_pcr_mask != 0) {
                         r = tpm2_load_pcr_public_key(arg_tpm2_public_key, &pubkey.iov_base, &pubkey.iov_len);
                         if (r < 0) {