TPM2 error using sudo zypper dup

[WimDeWinter]

After my daily sudo zypper dup I get the following errors at the end

Cache read/write disabled: interface file missing. (Kernel needs AppArmor 2.4 compatibility patch.)
Warning: unable to find a suitable fs in /proc/mounts, is it mounted?
Use --subdomainfs to override.
(322/322) Installing: google-chrome-stable-153.0.8010.47-1.x86_64 ..........................................................................[done]
%posttrans(coreutils-9.11-5.1.x86_64) script output:
WARNING: PCRs 9 dropped from the policy (PolicyOR)
WARNING: Error creating the systemd-pcrlock policy!
WARNING:esys:src/tss2-esys/api/Esys_PolicyOR.c:286:Esys_PolicyOR_Finish() Received TPM Error 
ERROR:esys:src/tss2-esys/api/Esys_PolicyOR.c:100:Esys_PolicyOR() Esys Finish ErrorCode (0x000001c4) 
None of the alternative values for PCR 4 encoded in policy match the current TPM state. Either the system has been tempered with or the provided policy is incorrect.
WARNING: The TPM2 policy cannot be re-authorized: PCR 4,7,9 moved. No recovery PIN was available, so every new run fails the same way
WARNING: PCR 4 measures the boot loader binaries. A shim, systemd-boot or GRUB2 update moves it, and so does booting another entry
WARNING: PCR 7 measures secure boot state and certificates. Toggling secure boot, or a keys, db or dbx update, moves it
WARNING: PCR 9 measures the kernel and initrd. A kernel or initrd update moves it
WARNING: If you made no such change, the boot path was altered. Both fixes below trust the current state, so explain it first
WARNING: With the recovery PIN: re-run with --ask-recovery-pin (or RECOVERY_PIN=...)
WARNING: Without it: check that a password opens the devices, then 'sdbootutil unenroll --method=tpm2+pin' and 'sdbootutil enroll --method=tpm2+pin --ask-recovery-pin'
warning: %posttrans(coreutils-9.11-5.1.x86_64) scriptlet failed, exit status 1
Error from %posttrans(coreutils-9.11-5.1.x86_64)
%posttrans(selinux-policy-targeted-20260910-1.1.noarch) script output:
++ SELINUX=enforcing
++ SELINUXTYPE=targeted
++ SELINUX=enforcing
++ SELINUXTYPE=targeted
skipping the directory /sys
skipping the directory /proc
skipping the directory /mnt
skipping the directory /var/tmp
skipping the directory /home
skipping the directory /root
skipping the directory /tmp

I can however boot my system in what seems the correct way by entering my password for decrypting LUKS and another one for logging in to my account.

I find this line intriguing:

WARNING: If you made no such change, the boot path was altered. Both fixes below trust the current state, so explain it first

I obviously can’t explain it. I did recently add the google chrome repo and installed distrobox from the opensuse repos, so nothing funny. I only do sudo zypper dup, doesn’t seem suspicious? But I can’t explain why the boot path was altered.

FYI:

wim@linux:~> zypper lr
Repository priorities are without effect. All enabled repositories share the same priority.

#  | Alias                                | Name                                   | Enabled | GPG Check | Refresh
---+--------------------------------------+----------------------------------------+---------+-----------+--------
 1 | download.opensuse.org-non-oss        | Main Repository (NON-OSS)              | Yes     | (r ) Yes  | Yes
 2 | download.opensuse.org-oss            | Main Repository (OSS)                  | Yes     | (r ) Yes  | Yes
 3 | download.opensuse.org-tumbleweed     | Main Update Repository                 | Yes     | (r ) Yes  | Yes
 4 | google-chrome                        | google-chrome                          | Yes     | (r ) Yes  | Yes
 5 | https-download.opensuse.org-13e3238f | Printing                               | Yes     | (r ) Yes  | Yes
 6 | https-download.opensuse.org-64fba157 | openSUSE:Tumbleweed                    | Yes     | (r ) Yes  | Yes
 7 | https-download.opensuse.org-8853f915 | openSUSE:Tumbleweed                    | Yes     | (r ) Yes  | Yes
 8 | openSUSE-20260429-1                  | openSUSE-20260429-1                    | Yes     | (r ) Yes  | Yes
 9 | repo-debug                           | openSUSE-Tumbleweed-Debug              | No      | ----      | ----
10 | repo-openh264                        | Open H.264 Codec (openSUSE Tumbleweed) | Yes     | (r ) Yes  | Yes
11 | repo-source                          | openSUSE-Tumbleweed-Source             | No      | ----      | ----

For what it’s worth, here’s the firmware security overview from the info center:

Idle…
Host Security ID: HSI:1! (v2.1.7)

HSI-1
BIOS firmware updates: Enabled
MEI key manifest: Valid
csme16 override: Locked
csme16 v16.1.32.2418: Valid
Platform debugging: Disabled
SPI write: Disabled
SPI lock: Enabled
SPI BIOS Descriptor: Locked
SPI BIOS region: Locked
Supported CPU: Valid
TPM empty PCRs: Valid
TPM v2.0: Found
UEFI bootservice variables: Locked
UEFI platform key: Valid

HSI-2
Intel BootGuard ACM protected: Valid
Intel BootGuard: Enabled
Intel BootGuard OTP fuse: Valid
Intel BootGuard verified boot: Valid
Intel GDS mitigation: Enabled
IOMMU: Enabled
Platform debugging: Locked
TPM PCR0 reconstruction: Valid
✘ HP SureStart: Disabled
✘ Locked MTD: Not supported
✘ Locked MTD: Not supported

HSI-3
CET Platform: Supported
Intel BootGuard error policy: Valid
Pre-boot DMA protection: Enabled
Suspend-to-idle: Enabled
Suspend-to-ram: Disabled
✘ UEFI memory protection: Unlocked

HSI-4
SMAP: Enabled
✘ Encrypted RAM: Not supported
✘ Hardware disk encryption: Not supported

Runtime Suffix -!
CET OS Support: Supported
fwupd plugins: Untainted
Linux swap: Encrypted
Linux kernel: Untainted
UEFI db: Valid
UEFI NX protection: Enabled
✘ Linux kernel lockdown: Disabled
✘ UEFI secure boot: Disabled

This system has HSI runtime issues.
» https://fwupd.github.io/hsi.html#hsi-runtime-suffix

Host Security Events
2026-06-23 13:13:57: ✘ UEFI memory protection changed: Disabled → Unlocked
2026-05-09 05:20:44: Linux swap changed: Unencrypted → Encrypted
2026-05-01 18:44:36: csme manufacturing mode changed: Locked → Locked
2026-05-01 15:18:25: ✘ Kernel lockdown disabled
2026-05-01 15:18:25: ✘ Secure Boot disabled

I’m using Tumbleweed with the latest updates installed on an HP Elitebook 650 with a very bloated “secure” HP bios.

Kind regards.

[hcvv]

@WimDeWinter

wim@linux:~> zypper lr

I do not know if this is needed, but when you want to show your repos, then please use a list that includes the URLs. As it is now it is in fact useless. E.g. zypper lr -d.

[restauranter]

Perhaps it is related to this: https://old.reddit.com/r/linux/comments/1whsg46/ysk_if_you_use_a_tpm_new_changes_in_systemd_and/

[WimDeWinter]

Thanks, I’ll keep that in mind!

[WimDeWinter]

That could be. I don’t know. How can I possibly find out what the problem is/could be. I try to keep my system updated. The first thing I do after logging in is flatpak update and sudo zypper dup. I did perform a dbx update as it popped up in “Discover”. (I use KDE), but that was after this issue appeared.

Talking of “Discover”, the KDE application explorer used by plasma, it updates without mentioning any problems/issues/errors. So for even more unexperienced users not bothering with cli everything seems fine.

I’m just a gardener with an interest in getting as far away as possible from big tech. I run graphene os on my pixel. I am a happy linux user/opensuse user. I don’t mind exploring, trying, failing, cursing, cli commands, searching forums, reading up on things …

But this is above my paygrade. Information about this is scarce. I’m not sure how to proceed. Do I use sdbootutil enroll, do nothing, reinstall, revert to previous snapshot, no idea.

But thanks for your input, much appreciated!

[WimDeWinter]

Also, Myrlyn[root] updates without mentioning any issues.

[WimDeWinter]

After tonights sudo zypper dup: No more TPM errors? Well no errors period. As always with tumbleweed: don’t panic, wait a while and it will all be fixed in the next update (or after some updates.)

[WimDeWinter]

So not completely solved. New error after sudo zypper dup but with another posttrans script after updating openSUSE Tumbleweed 20260922-0 → 20260923-0

%posttrans(selinux-policy-targeted-20260923-1.1.noarch) script output:
++ SELINUX=enforcing
++ SELINUXTYPE=targeted
++ SELINUX=enforcing
++ SELINUXTYPE=targeted
skipping the directory /sys
skipping the directory /proc
skipping the directory /mnt
skipping the directory /var/tmp
skipping the directory /home
skipping the directory /root
skipping the directory /tmp
%posttrans(thin-provisioning-tools-1.3.4-1.1.x86_64) script output:
WARNING: PCRs 9 dropped from the policy (PolicyOR)
WARNING: Error creating the systemd-pcrlock policy!
WARNING:esys:src/tss2-esys/api/Esys_PolicyOR.c:286:Esys_PolicyOR_Finish() Received TPM Error 
ERROR:esys:src/tss2-esys/api/Esys_PolicyOR.c:100:Esys_PolicyOR() Esys Finish ErrorCode (0x000001c4) 
None of the alternative values for PCR 4 encoded in policy match the current TPM state. Either the system has been tempered with or the provided policy is incorrect.
WARNING: The TPM2 policy cannot be re-authorized: PCR 4,7,9 moved. No recovery PIN was available, so every new run fails the same way
WARNING: PCR 4 measures the boot loader binaries. A shim, systemd-boot or GRUB2 update moves it, and so does booting another entry
WARNING: PCR 7 measures secure boot state and certificates. Toggling secure boot, or a keys, db or dbx update, moves it
WARNING: PCR 9 measures the kernel and initrd. A kernel or initrd update moves it
WARNING: If you made no such change, the boot path was altered. Both fixes below trust the current state, so explain it first
WARNING: With the recovery PIN: re-run with --ask-recovery-pin (or RECOVERY_PIN=...)
WARNING: Without it: check that a password opens the devices, then 'sdbootutil unenroll --method=tpm2+pin' and 'sdbootutil enroll --method=tpm2+pin --ask-recovery-pin'
warning: %posttrans(thin-provisioning-tools-1.3.4-1.1.x86_64) scriptlet failed, exit status 1
Error from %posttrans(thin-provisioning-tools-1.3.4-1.1.x86_64)
Running post-transaction scripts ...........................................................................................................[done]
There are running programs which still use files and libraries deleted or updated by recent upgrades. They should be restarted to benefit from the latest updates. Run 'zypper ps -s' to list these programs.

I filed a bug report, see how that goes.