diff options
author | Lennart Poettering <lennart@poettering.net> | 2022-04-21 11:24:37 +0200 |
---|---|---|
committer | Lennart Poettering <lennart@poettering.net> | 2022-04-22 10:15:21 +0200 |
commit | 44d5dd655e0eb33f15017b252a2a8a03e8e95599 (patch) | |
tree | 2be0b3e17f99fdf240dd560076ecde533681d627 /src/shared/tpm2-util.c | |
parent | 2338b8f9c56e0b14f25e8633f6e8e636e68638c8 (diff) | |
download | systemd-44d5dd655e0eb33f15017b252a2a8a03e8e95599.tar.gz |
tpm2-util: if we run in a container, ignore /sys/class/tpmrm/* contents
Diffstat (limited to 'src/shared/tpm2-util.c')
-rw-r--r-- | src/shared/tpm2-util.c | 19 |
1 files changed, 13 insertions, 6 deletions
diff --git a/src/shared/tpm2-util.c b/src/shared/tpm2-util.c index 62ba4b0ba8..2d1bc7cf46 100644 --- a/src/shared/tpm2-util.c +++ b/src/shared/tpm2-util.c @@ -5,6 +5,7 @@ #include "parse-util.h" #include "stat-util.h" #include "tpm2-util.h" +#include "virt.h" #if HAVE_TPM2 #include "alloc-util.h" @@ -1460,12 +1461,18 @@ Tpm2Support tpm2_support(void) { Tpm2Support support = TPM2_SUPPORT_NONE; int r; - r = dir_is_empty("/sys/class/tpmrm"); - if (r < 0) { - if (r != -ENOENT) - log_debug_errno(r, "Unable to test whether /sys/class/tpmrm/ exists and is populated, assuming it is not: %m"); - } else if (r == 0) /* populated! */ - support |= TPM2_SUPPORT_DRIVER; + if (detect_container() <= 0) { + /* Check if there's a /dev/tpmrm* device via sysfs. If we run in a container we likely just + * got the host sysfs mounted. Since devices are generally not virtualized for containers, + * let's assume containers never have a TPM, at least for now. */ + + r = dir_is_empty("/sys/class/tpmrm"); + if (r < 0) { + if (r != -ENOENT) + log_debug_errno(r, "Unable to test whether /sys/class/tpmrm/ exists and is populated, assuming it is not: %m"); + } else if (r == 0) /* populated! */ + support |= TPM2_SUPPORT_DRIVER; + } if (efi_has_tpm2()) support |= TPM2_SUPPORT_FIRMWARE; |