From: Paul Meyer <katexochen0@gmail.com>
Date: Mon, 29 Jun 2026 10:59:45 +0000 (+0200)
Subject: tsm-report: error on empty report
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=d17873f98fc4d992b7fd0f86e56999d27860d27d;p=thirdparty%2Fsystemd.git

tsm-report: error on empty report

Previously we would return a valid signature containing the empty
outblob, which is undesirable. In other cases where we cannot query a
report because the guest doesn't support it we currently return an
empty response so the signature aggregator in systemd-report silently
skips it. In this case, we have everything we need to actually get a
report on the guest side, but the host isn't providing us with the
quote, so we fail.

Signed-off-by: Paul Meyer <katexochen0@gmail.com>
---

diff --git a/src/shared/tsm-report.c b/src/shared/tsm-report.c
index d10eb7fdbfa..ae57201f6c8 100644
--- a/src/shared/tsm-report.c
+++ b/src/shared/tsm-report.c
@@ -142,6 +142,14 @@ static int tsm_report_fill(
         if (r < 0)
                 return log_debug_errno(r, "Failed to read 'provider' attribute: %m");
 
+        /* A zero-length outblob is never a valid attestation report, e.g. under Intel TDX the kernel
+         * yields an empty quote when the GetQuote round-trip to the host's Quote Generation Service
+         * produced nothing. */
+        if (!iovec_is_set(&report->outblob))
+                return log_debug_errno(SYNTHETIC_ERRNO(ENODATA),
+                                       "TSM provider '%s' returned an empty 'outblob'; no attestation report available.",
+                                       report->provider);
+
         r = read_full_file_at(entry_fd, "auxblob",
                               (char**) &report->auxblob.iov_base, &report->auxblob.iov_len);
         if (r < 0 && r != -ENOENT) /* auxblob is optional */