(Re-)installed Tumbleweed this weekend and I’m guessing I keep failing at properly setting up cryptenroll to automatically unlock my LUKS2 encrypted /root partition.
I followed this quickstart guide. First on the day I installed TW, but sdbootutil enroll --method tpm2 returned an error so I tried to set it up with the help of a LLM but that didn’t get it to work either. Yesterday I again tried the sdbootutil enroll --method tpm2 again and it at least didn’t return any errors. Konsole said enrolled key in slot 2, wiped slot 1 with slot 1 being the key I set up with systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=0+7 /dev/nvme0n1p2 .
When trying to login this morning, after choosing the most recent snapshot to boot into and putting in my LUKS2 password (so TPM unlock obviously still doesn’t work) it lead to what you can see in this picture:
[Sorry for only having the pictures from my phone, I tried to export the journalctl to a USB drive but I couldn’t mount the ext4 partitioned flash drive and was then too lazy/frustrated to change that.
So I rebooted and chose the second from the top boot option, with kernel 7.0.3, which works fine. From what I understand, /crypttab and /cmdline are important files for unlocking with TPM2:
suse@linux:~> sudo cat /etc/crypttab
[sudo] password for root:
# File created by sdbootutil. Comments will be removed
# Add the 'x-sdbootutil.ignore' option to un-track a device
#cr_root UUID=luksuuid none tpm2-device=auto,tpm2-pcrs=0+7,x-initrd.attach,tpm2-measure-pcr=yes
cr_root UUID=luksuuid none discard [NOTE: Commented out the above line and am hoping that I have now fully deactived cryptenroll, so that at least I can always boot into the newest snapshot by using my password]
suse@linux:~> sudo cat /etc/kernel/cmdline
rd.luks.uuid=luksuuid root=UUID=rootuuid rootflags=subvol=@/.snapshots/1/snapshot splash=silent mitigations=auto quiet security=selinux selinux=1
suse@linux:~> lsblk -f
nvme0n1
├─nvme0n1p1 vfat FAT32 959F-22CF 1,4G 27% /boot/efi
├─nvme0n1p2 crypto_LUKS 2 luksuuid
│ └─cr_root btrfs rootuuid 1,7T 4% /var
│ /usr/local
│ /srv
│ /home
│ /root
│ /opt
│ /.snapshots
│ /
Anybody see anything wrong?