From: Yu Watanabe <watanabe.yu+github@gmail.com>
Date: Sat, 25 May 2024 19:42:16 +0000 (+0900)
Subject: cryptenroll: do not pass an empty pcrlock policy
X-Git-Tag: v256-rc4~125^2~1
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=16f51e2909be4714496a1bf5173489c9a7e43efb;p=thirdparty%2Fsystemd.git

cryptenroll: do not pass an empty pcrlock policy

Otherwise, tpm2_uneal() -> tpm2_build_sealing_policy() ->
tpm2_deserialize() will trigger assertion.

Prompted by #33017.
---

diff --git a/src/cryptenroll/cryptenroll-tpm2.c b/src/cryptenroll/cryptenroll-tpm2.c
index 4e5d02a97e7..10bd8d77237 100644
--- a/src/cryptenroll/cryptenroll-tpm2.c
+++ b/src/cryptenroll/cryptenroll-tpm2.c
@@ -342,6 +342,8 @@ int enroll_tpm2(struct crypt_device *cd,
                 r = tpm2_pcrlock_policy_load(pcrlock_path, &pcrlock_policy);
                 if (r < 0)
                         return r;
+                if (r == 0)
+                        return log_error_errno(SYNTHETIC_ERRNO(ENOENT), "Couldn't find pcrlock policy %s.", pcrlock_path);
 
                 any_pcr_value_specified = true;
                 flags |= TPM2_FLAGS_USE_PCRLOCK;