From f31a87331f0703896708416dbb19aed4ed9b7fe9 Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Mon, 2 Jun 2025 13:12:28 +0200 Subject: [PATCH] tpm2-util: also generate recognizable error if PolicyAuthorizeNV fails --- src/shared/tpm2-util.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/src/shared/tpm2-util.c b/src/shared/tpm2-util.c index 103cf505813..7e2a84bfee0 100644 --- a/src/shared/tpm2-util.c +++ b/src/shared/tpm2-util.c @@ -3661,6 +3661,11 @@ int tpm2_policy_authorize_nv( ESYS_TR_PASSWORD, ESYS_TR_NONE, ESYS_TR_NONE); + if ((rc & ~(TPM2_RC_N_MASK|TPM2_RC_P)) == TPM2_RC_VALUE) /* Return a recognizable error if the policy + * in the NV index does not match what we + * just put together */ + return log_debug_errno(SYNTHETIC_ERRNO(EREMCHG), + "Submitted policy does not match policy stored in PolicyAuthorizeNV."); if (rc != TSS2_RC_SUCCESS) return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE), "Failed to add AuthorizeNV policy to TPM: %s", -- 2.47.3