[isar-cip-core][PATCH 2/2] Kconfig: Do not offer factory reset with full disk encryption enabled.
| Newsgroups | org.cip-project.lists.cip-dev |
|---|---|
| Message-ID | <[email protected]> |
From: Alexander Heinisch <[email protected]> By default factory reset clears the tpm. Therefore, keys needed to decrypt the immutable A/B rootfs in full disk encryption setups cannot be retrieved anymore. Thus, the boot fails and the device cannot be recovered. Signed-off-by: Alexander Heinisch <[email protected]> --- Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Kconfig b/Kconfig index abf9aaf..55911da 100644 --- a/Kconfig +++ b/Kconfig @@ -359,7 +359,7 @@ config SEPARATE_HOME_PARTITION config FACTORY_RESET bool "Enable factory reset" - depends on IMAGE_SWUPDATE && (HAS_EFIVARS || !(IMAGE_FULL_ENCRYPTION || IMAGE_DATA_ENCRYPTION)) + depends on IMAGE_SWUPDATE && (HAS_EFIVARS || !IMAGE_DATA_ENCRYPTION) && !IMAGE_FULL_ENCRYPTION help This adds the necessary packages to request and execute a factory reset of the persistent partition. See also ./doc/README.factory-reset.md. -- 2.47.3