tpm2-util: Align tpm2_import with tpm2_load to report on foreign keys

When we encounter a key for a foreign TPM we report that as EREMOTE in
tpm2_load but not yet in tpm2_import. This causes cryptsetup to give up
on using the TPM instead of being able to continue with out tokens.
Do the same mapping as in tpm2_load in tpm2_import to report EREMOTE on
foreign keys.

diff --git a/src/shared/tpm2-util.c b/src/shared/tpm2-util.c
index a60eca51acbb43a181314ea3481ccb0f6a6fc3a7..4010eaeffec4bf7e9f787c4f66219553a42e3140 100644 (file)
--- a/src/shared/tpm2-util.c
+++ b/src/shared/tpm2-util.c
@@ -3454,6 +3454,9 @@ static int tpm2_import(
                         seed,
                         symmetric ?: &(TPMT_SYM_DEF_OBJECT){ .algorithm = TPM2_ALG_NULL, },
                         ret_private);
+        if ((rc & ~(TPM2_RC_N_MASK|TPM2_RC_P)) == TPM2_RC_INTEGRITY) /* Return a recognizable error if this key does not belong to the local TPM */
+                return log_debug_errno(SYNTHETIC_ERRNO(EREMOTE),
+                                       "Key invalid or does not belong to current TPM.");
         if (rc != TSS2_RC_SUCCESS)
                 return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
                                        "Failed to import key into TPM: %s", sym_Tss2_RC_Decode(rc));