meta-encrypted-storage use case 2 luks-setup.sh issues

[hmckinlay]

Hi Jiazhang0,

I am working through using meta-encrypted-storage following section use case 2: luks-setup.sh and have encountered some issues. I am using branch Sumo but this doesn't seem to have changed much since then afaik.

1. In luks-setup.sh, the parameters for tpm2_takeownership don't work for me. --LockPasswd i believe is --lock-passwd. If you do set a lock password tpm2_dictionarylockout fails. I think this is because setting a password requires the clearing and the settings of the password to be two commands. This worked for me:

Replacing
[ -n "$OPT_LOCKOUT_AUTH" ] && cmd="${cmd} --lockPasswd $OPT_LOCKOUT_AUTH"
With
[ -n "$OPT_LOCKOUT_AUTH" ] && cmd="${cmd} && tpm2_takeownership --lock-passwd $OPT_LOCKOUT_AUTH"

2. If a partition exists the script fails to wait for the user to acknowledge the overwrite of the existing partition and errors with Unable to create the LUKS partition on $luks_dev. This worked for me:

Replacing
! cryptsetup --type luks --cipher aes-xts-plain --hash sha256
--use-random --key-file "$passphrase" luksFormat "$luks_dev" &&
print_error "Unable to create the LUKS partition on $luks_dev" &&
return 1

With
cmd="cryptsetup --type luks --cipher aes-xts-plain --hash sha256
--use-random --key-file '$passphrase' luksFormat '$luks_dev'"
eval "$cmd"
if [ $? -ne 0 ]; then
print_error "Unable to create the LUKS partition on $luks_dev"
return 1
fi

3. Once the LUKS partition is created, the next step in the guide Retrieve the passphrase errors out as below:

root@hwr-01:~# cryptfs-tpm2 -q unseal passphrase -P sha256 -o /tmp/passphrase
Wed Mar 27 01:27:59 UTC 2019: [INFO] Use tabrmd as the default tcti interface
Wed Mar 27 01:27:59 UTC 2019: [ERROR] Unable to find out the tabrmd tcti library
Wed Mar 27 01:27:59 UTC 2019: [ERROR] Unable to get the TPM PCR banks (0x80005)Wed Mar 27 01:27:59 UTC 2019: [ERROR] Unsupported PCR bank algorithm

Just wondering your thoughts on if I am missing something obvious or how to proceed with 3.

Kind Regards,
Ham.