systemd / systemd / 27451129235

73%

Build Type

push

github

Committed by keszybz

Commit Message

pcrextend: skip measurement gracefully when the TPM can't be used

So far --graceful only short-circuited when no TPM was present at all (the
!tpm2_is_mostly_supported() check). If a TPM is present but can't actually be
used for the measurement we want, the measurement still failed hard. For
systemd-pcrextend instances ordered before sysinit.target this pushes the
system to degraded and blocks boot, which defeats the purpose of --graceful.

Make the two extend helpers report every "TPM is present-or-absent but cannot
be used for this measurement" condition with a single errno, -EOPNOTSUPP: no
usable PCR bank, no TPM device, missing crypto (e.g. AES-128-CFB), no NvPCR
support, and OpenSSL-less builds. tpm2_context_new_or_warn() reports a missing
device as -ENOENT, so each helper translates that to -EOPNOTSUPP at the call
site, keeping every errno single-meaning.

Co-developed-by: Claude Opus 4.8 <noreply@anthropic.com>

Coverage Stats

9 of 11 new or added lines in 1 file covered. (81.82%)

260 existing lines in 35 files now uncovered.

337094 of 462492 relevant lines covered (72.89%)

1285662.78 hits per line