harald/VerityBook
1
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

pre-pivot.sh: don't remove the initial keyslot

Browse source 
It is needed, if the user wants to set a password
This commit is contained in:
Harald Hoyer 2018-09-05 15:12:53 +02:00
parent 2bd0b8d314
commit a2f5682cec
1 changed files with 0 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
pre-pivot.sh
View file

@ -58,10 +58,8 @@ if cryptsetup isLuks --type luks2 "$datadev"; then
export TPM2TOOLS_DEVICE_FILE=/dev/tpmrm0
if echo -n "zero key" | clevis-luks-bind -f -k - -d "$datadev" tpm2 '{"pcr_ids":"7"}'; then
echo -n "zero key" | cryptsetup luksRemoveKey "$datadev" /dev/stdin || die "Failed to remove key from LUKS"
clevis-luks-unlock -d "$datadev" -n "$luksname" || die "Failed to unlock $datadev"
elif echo -n "zero key" | clevis-luks-bind -f -k - -d "$datadev" tpm2 '{"pcr_ids":"7","key":"rsa"}'; then
echo -n "zero key" | cryptsetup luksRemoveKey "$datadev" /dev/stdin || die "Failed to remove key from LUKS"
clevis-luks-unlock -d "$datadev" -n "$luksname" || die "Failed to unlock $datadev"
else
warn "Failed to bind disk to TPM2"