tpm: T7713: T7717: Multiple TPM fixes #4669

sarthurdev · 2025-08-19T18:45:02Z

Change summary

T7727: Adds prompt to overwrite existing config backup
T7727: Move volume checks before prompting for key/recovery key
T7720: Catch errors during config encryption and gracefully abort
T7717: Recursively set vyattacfg group on mounted config directory
T7713: Restore config bind mounts on config decrypt
T7735: Don't prompt for key/recovery key if encrypted volume is mounted
T7726: Copy encrypted config volume when using add system image
T7726: Prompt user before clearing TPM on decrypt

Includes minor formatting changes, single-line imports.

Types of changes

Bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)
Code style update (formatting, renaming)
Refactoring (no functional changes)
Migration from an old Vyatta component to vyos-1x, please link to related PR inside obsoleted component
Other (please describe):

Related Task(s)

Related PR(s)

How to test / Smoketest result

make testtpm passes and all error steps reported in Phorge now succeed.

Checklist:

I have read the CONTRIBUTING document
I have linked this PR to one or more Phabricator Task(s)
I have run the components SMOKETESTS if applicable
My commit headlines contain a valid Task id
My change requires a change to the documentation
I have updated the documentation accordingly

github-actions · 2025-08-19T18:45:17Z

👍
No issues in PR Title / Commit Title

alexk37 · 2025-08-20T14:59:42Z

@sarthurdev please check the following scenario (TPM emulation is on):

encryption enable
reboot
encryption disable

encryption disable fails with the following error:

vyos@vyos:~$ encryption disable 
Moving existing /config folder to /config.old
Failed to decrypt config: [Errno 32] failed to run command: None mount --bind /lib/live/mount/persistence/boot/2025.08.19-1848-integration/rw/config /opt/vyatta/etc/config
returned: 
exit code: 32

the actual error:

mount: /opt/vyatta/etc/config: mount(2) system call failed: No such file or directory.
       dmesg(1) may have more information after failed mount system call.

It seems like at this point the /opt/vyatta/etc/config folder gets corrupted

alexk37 · 2025-08-21T11:24:34Z

@sarthurdev when disabling encryption - if we choose not to overwrite the existing config backup config.old further encryption enable aborts:

vyos@vyos:~$ encryption disable 
Moving existing /config folder to /config.old
Backup config path "/config.old" already exists. Overwrite? [y/N] 
Encrypted config volume has been disabled
Contents have been migrated to /config on rootfs

vyos@vyos:~$ encryption enable 
An encrypted config volume is already mapped, aborting.

alexk37 · 2025-08-22T15:41:06Z

@sarthurdev add system image fails if we choose not to copy the active configuration:

vyos@vyos:~$ add system image vyos-2025.08.18-0022-rolling-generic-amd64.iso
Validating image compatibility
Validating image checksums
What would you like to name this image? (Default: 2025.08.18-0022-rolling) 
Would you like to set the new image as the default one for boot? [Y/n] 
An active configuration was found. Would you like to copy it to the new image? [Y/n] n
Cleaning up
Unmounting target filesystems
Removing temporary files
Error: [Errno 2] No such file or directory: '/usr/lib/live/mount/persistence/boot/2025.08.18-0022-rolling/rw/opt/vyatta/etc/config//config.boot'

vyos@vyos:~$ show system image 
Name                         Default boot    Running
---------------------------  --------------  ---------
2025.08.19-1848-integration  Yes             Yes

Exception occurs at this step of the process

alexk37 · 2025-08-25T11:24:54Z

@sarthurdev in case we have image1 and image2
if we encrypt config in image1 and then in image2 - the second encryption overwrites TPM so the image1 can't load the config

sarthurdev · 2025-08-27T08:40:47Z

Thanks Alex, I'll update the PR this week.

sarthurdev · 2025-09-09T15:36:13Z

@alexk37 Hey Alex, if you have any time to check the new integration ISO?

I've done testing on the scenarios you've described and I think they should all be addressed now.

alexk37 · 2025-09-13T11:26:00Z

@sarthurdev Hi Simon, kindly check the following issues, they reproduce in vyos-2025.09.09-1525-integration

Encryption disable after reboot
Add system image fails when we select not to copy the active configuration
If we choose to overwrite TPM with new key and then try to load the image which was encrypted previously - not possible to use recovery key for 'encryption load/disable'. So the case is when we have a key in TPM (it is not empty) but not able to decrypt it - error occurs and no option to use recovery key is given

Detailed testing log is available in Jira - https://internal.jira.vyos.com/browse/VD-1447?focusedCommentId=28569

sever-sever

Rolling is a good candidate for check fixes.

alexk37 · 2025-09-13T17:13:34Z

@sever-sever apart from some tpm issues, currently there is an issue which causes 'add system image' to fail if we choose not to copy the active config, just wanted to inform in case this is major issue for rolling

sarthurdev · 2025-09-13T20:18:06Z

@sever-sever apart from some tpm issues, currently there is an issue which causes 'add system image' to fail if we choose not to copy the active config, just wanted to inform in case this is major issue for rolling

I'm not sure that issue relates to the TPM code or changes in this PR?

When I had a quick look it might be relating to this commit 3fe5f8f and might be better suited as a separate task.

Edit:

From latest rolling

Copying SSH host keys
Copying system image files
Cleaning up
Unmounting target filesystems
Removing temporary files
Cleaning up
Unmounting target filesystems
Removing temporary files
Error: [Errno 2] No such file or directory: '/usr/lib/live/mount/persistence/boot/asd/rw/opt/vyatta/etc/config//config.boot'
vyos@vyos:~$ sh ver
Version:          VyOS 2025.09.10-0018-rolling
Release train:    current
Release flavor:   generic

Built by:         [email protected]
Built on:         Wed 10 Sep 2025 00:18 UTC
Build UUID:       846c1b06-a380-48fa-b3dd-d954700da0a2
Build commit ID:  c6d3547904cfac

alexk37 · 2025-09-14T01:59:09Z

@sarthurdev you are right, the error itself is related to another commit. With TPM changes the failing line of code was moved up so the image installation code is not executed anymore

UPD:
The root cause bug reported in T7818

github-actions · 2025-09-20T16:11:27Z

This pull request has conflicts, please resolve those before we can evaluate the pull request.

sever-sever

There are conflicts

 src/helpers/vyos-config-encrypt.py
5 conflicts


<<<<<<< tpm_fixes
from vyos.utils.process import cmd, run
=======
from vyos.utils.process import cmd
from vyos.defaults import directories
>>>>>>> current


<<<<<<< tpm_fixes
    for path in mount_paths:
        run(f'umount -l {path}')
        cmd(f'mount /dev/mapper/vyos_config {path}')
        cmd(f'chgrp -R vyattacfg {path}')
=======
    cmd(f'mount /dev/mapper/vyos_config {mount_path}')
    cmd(f'chgrp -R vyattacfg {mount_path}')
>>>>>>> current

github-actions · 2025-09-22T23:01:45Z

Conflicts have been resolved. A maintainer will review the pull request shortly.

github-actions · 2025-09-23T13:10:06Z

This pull request has conflicts, please resolve those before we can evaluate the pull request.

Move encrypted volume check before key input Unmount any conflicting config bind mounts

github-actions · 2025-09-23T18:35:06Z

Conflicts have been resolved. A maintainer will review the pull request shortly.

…mports

github-actions · 2025-09-23T21:29:08Z

CI integration 👍 passed!

Details

CI logs

CLI Smoketests (no interfaces) 👍 passed
CLI Smoketests VPP 👍 passed
CLI Smoketests (interfaces only) 👍 passed
Config tests 👍 passed
Config tests VPP 👍 passed
RAID1 tests 👍 passed
TPM tests 👍 passed

sever-sever

Rolling is a good candidate for check fixes.

dmbaturin

I don't see any issues and now all suggestions are implemented, so let's give it a try.

sarthurdev added the bp/circinus Create automatic backport for circinus label Aug 19, 2025

github-actions bot assigned sarthurdev Aug 19, 2025

github-actions bot added the current label Aug 19, 2025

sarthurdev force-pushed the tpm_fixes branch from 9b08d47 to 868f7f0 Compare September 9, 2025 13:05

github-actions bot added the rebase label Sep 9, 2025

sarthurdev force-pushed the tpm_fixes branch from 637cfd7 to 70629c7 Compare September 9, 2025 15:22

sarthurdev marked this pull request as ready for review September 11, 2025 14:12

sever-sever approved these changes Sep 13, 2025

View reviewed changes

sever-sever requested review from jestabro and c-po September 13, 2025 13:58

github-actions bot added the conflicts label Sep 20, 2025

sever-sever self-requested a review September 22, 2025 12:29

sever-sever requested changes Sep 22, 2025

View reviewed changes

sarthurdev force-pushed the tpm_fixes branch from 70629c7 to 90f97d8 Compare September 22, 2025 23:01

github-actions bot removed the conflicts label Sep 22, 2025

sarthurdev force-pushed the tpm_fixes branch from fc5ef6e to ac01dc7 Compare September 23, 2025 10:21

github-actions bot added the conflicts label Sep 23, 2025

sarthurdev added 3 commits September 23, 2025 20:32

tpm: T7727: Prompt to overwrite an existing backup

c7074d3

Move encrypted volume check before key input Unmount any conflicting config bind mounts

tpm: T7720: Handle encrypt failure and gracefully abort

0476b6b

tpm: T7717: Preserve group on config and archives

e5f06c4

sarthurdev force-pushed the tpm_fixes branch from ac01dc7 to 080f8f7 Compare September 23, 2025 18:32

github-actions bot removed the conflicts label Sep 23, 2025

sarthurdev added 7 commits September 23, 2025 21:25

tpm: T7713: Restore original config mounts when decrypting

b7c8955

tpm: T7735: Only require key/recovery if unmapped

645f921

tpm: T4919: Use vyos module function for running image, single-line i…

e98ae3e

…mports

tpm: T7726: Copy encrypted volume when adding system images

0f1430f

tpm: T7726: Prompt user before clearing TPM key

5865c42

tpm: T7726: Prompt before overwriting existing TPM key

a080cfa

tpm: T7726: Test TPM key or prompt recovery key

36d9d70

sarthurdev force-pushed the tpm_fixes branch from 080f8f7 to 36d9d70 Compare September 23, 2025 19:25

sever-sever approved these changes Sep 24, 2025

View reviewed changes

dmbaturin approved these changes Sep 25, 2025

View reviewed changes

dmbaturin merged commit 51b2d4d into vyos:current Sep 25, 2025
17 of 18 checks passed

vyosbot added mirror-initiated This PR initiated for mirror sync workflow mirror-completed and removed mirror-initiated This PR initiated for mirror sync workflow labels Sep 25, 2025

tpm: T7713: T7717: Multiple TPM fixes #4669

tpm: T7713: T7717: Multiple TPM fixes #4669

Uh oh!

Conversation

sarthurdev commented Aug 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Change summary

Types of changes

Related Task(s)

Related PR(s)

How to test / Smoketest result

Checklist:

Uh oh!

github-actions bot commented Aug 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

alexk37 commented Aug 20, 2025

Uh oh!

alexk37 commented Aug 21, 2025

Uh oh!

alexk37 commented Aug 22, 2025

Uh oh!

alexk37 commented Aug 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sarthurdev commented Aug 27, 2025

Uh oh!

sarthurdev commented Sep 9, 2025

Uh oh!

alexk37 commented Sep 13, 2025

Uh oh!

sever-sever left a comment

Choose a reason for hiding this comment

Uh oh!

alexk37 commented Sep 13, 2025

Uh oh!

sarthurdev commented Sep 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

alexk37 commented Sep 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Sep 20, 2025

Uh oh!

sever-sever left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Sep 22, 2025

Uh oh!

github-actions bot commented Sep 23, 2025

Uh oh!

github-actions bot commented Sep 23, 2025

Uh oh!

github-actions bot commented Sep 23, 2025

Details

Uh oh!

sever-sever left a comment

Choose a reason for hiding this comment

Uh oh!

dmbaturin left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

sarthurdev commented Aug 19, 2025 •

edited

Loading

github-actions bot commented Aug 19, 2025 •

edited

Loading

alexk37 commented Aug 25, 2025 •

edited

Loading

sarthurdev commented Sep 13, 2025 •

edited

Loading

alexk37 commented Sep 14, 2025 •

edited

Loading