tpm2-measure-nvpcr=no and invalid NvPCR names only affect the current
comma-separated option. They returned from parse_options(), so later
options were silently skipped.
Repro:
build/systemd-veritysetup attach testvol /dev/null /no/such \
0000000000000000000000000000000000000000000000000000000000000000 \
tpm2-measure-nvpcr=no,root-hash-signature=relative
Before: root-hash-signature=relative was skipped, and execution continued
to the missing block-device error.
After: root-hash-signature=relative is parsed and rejected. Invalid NvPCR
names take the same continue path.
Follow-up for:
85d7fb22470e5a4b17045d9288d4e2c06ff7b2e8
r = isempty(val) ? 0 : parse_boolean(val);
if (r == 0) {
arg_tpm2_measure_nvpcr = mfree(arg_tpm2_measure_nvpcr);
- return 0;
+ continue;
}
if (r > 0)
val = "verity";
else if (!tpm2_nvpcr_name_is_valid(val)) {
log_warning("Invalid NvPCR name, ignoring: %s", word);
- return 0;
+ continue;
}
if (free_and_strdup(&arg_tpm2_measure_nvpcr, val) < 0)