From: Kai Lüke <kai@amutable.com>
Date: Mon, 20 Apr 2026 09:45:22 +0000 (+0900)
Subject: tpm2-util: Align tpm2_import with tpm2_load to report on foreign keys
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=93bc6a3415a717106afdeaaf9bb3b7f025c12c70;p=thirdparty%2Fsystemd.git

tpm2-util: Align tpm2_import with tpm2_load to report on foreign keys

When we encounter a key for a foreign TPM we report that as EREMOTE in
tpm2_load but not yet in tpm2_import. This causes cryptsetup to give up
on using the TPM instead of being able to continue with out tokens.
Do the same mapping as in tpm2_load in tpm2_import to report EREMOTE on
foreign keys.
---

diff --git a/src/shared/tpm2-util.c b/src/shared/tpm2-util.c
index a60eca51acb..4010eaeffec 100644
--- a/src/shared/tpm2-util.c
+++ b/src/shared/tpm2-util.c
@@ -3454,6 +3454,9 @@ static int tpm2_import(
                         seed,
                         symmetric ?: &(TPMT_SYM_DEF_OBJECT){ .algorithm = TPM2_ALG_NULL, },
                         ret_private);
+        if ((rc & ~(TPM2_RC_N_MASK|TPM2_RC_P)) == TPM2_RC_INTEGRITY) /* Return a recognizable error if this key does not belong to the local TPM */
+                return log_debug_errno(SYNTHETIC_ERRNO(EREMOTE),
+                                       "Key invalid or does not belong to current TPM.");
         if (rc != TSS2_RC_SUCCESS)
                 return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
                                        "Failed to import key into TPM: %s", sym_Tss2_RC_Decode(rc));