[isar-cip-core][PATCH] initramfs-crypt-hook: Fix TPM shutdown to prevent invalid PCR states

From: Jan Kiszka <[email protected]>

A plain tpm2_shutdown means TPM_SU_STATE, and that means "save volatile
TPM state for later restoration". And that is actually done then by the
TPM also after cold boot (power-cut, hard reset), leading the non-zero
PCRs that are then extended by the firmware as usual but, due to the
non-zero base values, to inconsistent new values. This is breaking the
unsealing of the disk encryption key and other secrets stored in the
TPM.

Fix it by clearing the state on shutdown instead.

Fixes: e96ea24b4269 ("fix: Shutdown the TPM after disk are decrypted")
Signed-off-by: Jan Kiszka <[email protected]>
---

Seen with virtual fTPM (plus extra patches as the current firmware does 
not support measuring yet), but it may effect dTPMs and real deployments 
as well. The issue is normally "healed" by the panic-reboot that the 
initramfs will trigger if unlocking fails.

 recipes-initramfs/initramfs-crypt-hook/files/local-top-complete | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/recipes-initramfs/initramfs-crypt-hook/files/local-top-complete b/recipes-initramfs/initramfs-crypt-hook/files/local-top-complete
index 963f82fb..7bc08e55 100755
--- a/recipes-initramfs/initramfs-crypt-hook/files/local-top-complete
+++ b/recipes-initramfs/initramfs-crypt-hook/files/local-top-complete
@@ -367,7 +367,7 @@ done
 
 if [ -x /usr/bin/tpm2_shutdown ]; then
 	# shutdown the TPM to avoid DA lockout due to powerfailure
-	tpm2_shutdown
+	tpm2_shutdown -c
 fi
 
 if [ -n "$watchdog_pid" ]; then
-- 
2.47.3