{"action":"created","issue":{"url":"https://api.github.com/repos/electrickite/luks-tpm2/issues/1","repository_url":"https://api.github.com/repos/electrickite/luks-tpm2","labels_url":"https://api.github.com/repos/electrickite/luks-tpm2/issues/1/labels{/name}","comments_url":"https://api.github.com/repos/electrickite/luks-tpm2/issues/1/comments","events_url":"https://api.github.com/repos/electrickite/luks-tpm2/issues/1/events","html_url":"https://github.com/electrickite/luks-tpm2/issues/1","id":385676905,"node_id":"MDU6SXNzdWUzODU2NzY5MDU=","number":1,"title":"Failure to create a temporary password","user":{"login":"openmindead","id":36324977,"node_id":"MDQ6VXNlcjM2MzI0OTc3","avatar_url":"https://avatars3.githubusercontent.com/u/36324977?v=4","gravatar_id":"","url":"https://api.github.com/users/openmindead","html_url":"https://github.com/openmindead","followers_url":"https://api.github.com/users/openmindead/followers","following_url":"https://api.github.com/users/openmindead/following{/other_user}","gists_url":"https://api.github.com/users/openmindead/gists{/gist_id}","starred_url":"https://api.github.com/users/openmindead/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/openmindead/subscriptions","organizations_url":"https://api.github.com/users/openmindead/orgs","repos_url":"https://api.github.com/users/openmindead/repos","events_url":"https://api.github.com/users/openmindead/events{/privacy}","received_events_url":"https://api.github.com/users/openmindead/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2018-11-29T10:52:18Z","updated_at":"2018-11-29T15:22:32Z","closed_at":null,"author_association":"NONE","body":"Good day.\r\nFirst of all, thank you for your work, you've done a great job that looks very promising!\r\n\r\nIn general the tool works fine (init, reset, replace), but not a temp command:\r\n```\r\nsudo luks-tpm2 temp\r\n\r\nUsealing keyfile...\r\nERROR: \r\nLoad Object Failed ! ErrorCode: 0x902\r\n\r\nERROR: Unable to run tpm2_load\r\nERROR: Error opening file \"/root/keyfs/object.context\" due to error: No such file or directory\r\nERROR: Unable to run tpm2_unseal\r\nPreparing to set a temporary LUKS passphrase for /dev/nvme0n1p5...\r\nFailed to open key file.\r\nA temporary passphrase was not set\r\n```\r\n\r\nThis is what I get when pacman hook is executed:\r\n```\r\n[2018-11-29 13:39] [ALPM] running 'luks-tpm2.hook'...\r\n[2018-11-29 13:39] [ALPM-SCRIPTLET] Usealing keyfile...\r\n[2018-11-29 13:39] [ALPM-SCRIPTLET] ERROR: \r\n[2018-11-29 13:39] [ALPM-SCRIPTLET] Load Object Failed ! ErrorCode: 0x902\r\n[2018-11-29 13:39] [ALPM-SCRIPTLET] \r\n[2018-11-29 13:39] [ALPM-SCRIPTLET] ERROR: Unable to run tpm2_load\r\n[2018-11-29 13:39] [ALPM-SCRIPTLET] ERROR: Error opening file \"/root/keyfs/object.context\" due to error: No such file or directory\r\n[2018-11-29 13:39] [ALPM-SCRIPTLET] ERROR: Unable to run tpm2_unseal\r\n[2018-11-29 13:39] [ALPM-SCRIPTLET] Preparing to set a temporary LUKS passphrase for /dev/nvme0n1p5...\r\n[2018-11-29 13:39] [ALPM-SCRIPTLET] /usr/bin/luks-tpm2: line 94: /dev/tty: No such device or address\r\n[2018-11-29 13:39] [ALPM-SCRIPTLET] A temporary passphrase was not set\r\n```\r\n\r\nMy settings in /etc/default/luks-tpm2, the rest is unchanged:\r\n```\r\nSEALED_KEY_PUBLIC=\"/boot/efi/keyfile.pub\"\r\nSEALED_KEY_PRIVATE=\"/boot/efi/keyfile.priv\"\r\nPARENT_HANDLE=\"0x81000003\"\r\nROOT_DEVICE=\"/dev/nvme0n1p5\"\r\n```\r\n\r\nWhat should be in /root/keyfs?\r\n\r\nMy OS is Manjaro Linux."},"comment":{"url":"https://api.github.com/repos/electrickite/luks-tpm2/issues/comments/442872803","html_url":"https://github.com/electrickite/luks-tpm2/issues/1#issuecomment-442872803","issue_url":"https://api.github.com/repos/electrickite/luks-tpm2/issues/1","id":442872803,"node_id":"MDEyOklzc3VlQ29tbWVudDQ0Mjg3MjgwMw==","user":{"login":"openmindead","id":36324977,"node_id":"MDQ6VXNlcjM2MzI0OTc3","avatar_url":"https://avatars3.githubusercontent.com/u/36324977?v=4","gravatar_id":"","url":"https://api.github.com/users/openmindead","html_url":"https://github.com/openmindead","followers_url":"https://api.github.com/users/openmindead/followers","following_url":"https://api.github.com/users/openmindead/following{/other_user}","gists_url":"https://api.github.com/users/openmindead/gists{/gist_id}","starred_url":"https://api.github.com/users/openmindead/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/openmindead/subscriptions","organizations_url":"https://api.github.com/users/openmindead/orgs","repos_url":"https://api.github.com/users/openmindead/repos","events_url":"https://api.github.com/users/openmindead/events{/privacy}","received_events_url":"https://api.github.com/users/openmindead/received_events","type":"User","site_admin":false},"created_at":"2018-11-29T15:22:32Z","updated_at":"2018-11-29T15:22:32Z","author_association":"NONE","body":"OK it seems I bigin to understand what the problem is. Initially I used your README to set this up, and here is what I did and what I got:\r\n\r\n`sudo tpm2_listpersistent -T device:/dev/tpmrm0`\r\n\r\n> persistent-handle[0]:0x81000001 key-alg:rsa hash-alg:sha256 object-attr:fixedtpm|fixedparent|sensitivedataorigin|userwithauth|noda|restricted|decrypt\r\n> persistent-handle[1]:0x81000002 key-alg:rsa hash-alg:sha256 object-attr:fixedtpm|fixedparent|sensitivedataorigin|userwithauth|noda|restricted|sign\r\n> persistent-handle[2]:0x81010001 key-alg:rsa hash-alg:sha256 object-attr:fixedtpm|fixedparent|sensitivedataorigin|adminwithpolicy|restricted|decrypt\r\n\r\nThe above are handlers which existed before I created the others as follows:\r\n\r\n`sudo tpm2_createprimary -H o -g sha1 -G rsa -T device:/dev/tpmrm0`\r\n\r\n> ObjectAttribute: 0x00030072\r\n> \r\n> CreatePrimary Succeed ! Handle: 0x80000000\r\n\r\n`sudo tpm2_createprimary -H o -g sha256 -G rsa -T device:/dev/tpmrm0`\r\n\r\n> ObjectAttribute: 0x00030072\r\n> \r\n> CreatePrimary Succeed ! Handle: 0x80000001\r\n\r\n`sudo tpm2_evictcontrol -A o -H 0x80000000 -S 0x81000003 -T device:/dev/tpmrm0`\r\n\r\n> persistentHandle: 0x81000003\r\n\r\n`sudo tpm2_evictcontrol -A o -H 0x80000001 -S 0x81000004 -T device:/dev/tpmrm0`\r\n\r\n> persistentHandle: 0x81000004\r\n\r\nSo as you see I've created 2 handlers (just in case, for no reason) and used the first one for `init`.\r\nNow I tried the second one - `0x81000004`, and the `temp` command worked fine (haven't rebooted yet but I'm sure it will work):\r\n\r\n`sudo luks-tpm2 -p /boot/keyfile -H 0x81000003 /dev/nvme0n1p5 init`\r\n\r\n> Initializing LUKS TPM key for /dev/nvme0n1p5\r\n> WARNING: This will permanently delete the key in slot 1!\r\n> Do you wish to proceed? [Y/n]y\r\n> Enter any existing LUKS passphrase: \r\n> Generating new LUKS key...\r\n> Removing existing key from slot 1...\r\n> Adding new key to slot 1...\r\n> Sealing keyfile with the TPM...\r\n\r\n`sudo luks-tpm2 temp`\r\n\r\n> Usealing keyfile...\r\n> Preparing to set a temporary LUKS passphrase for /dev/nvme0n1p5...\r\n> Enter new passphrase for key slot: \r\n> Verify passphrase: \r\n> After booting into the current kernel, run\r\n>   luks-tpm2 reset\r\n> to generate a new LUKS key and remove this temporary key"}}
{"actor":{"display_login":"openmindead"}}