#49922 – Consider to add TPM2 and FIDO2 security devices suport for systemd.

Bug 49922 - Consider to add TPM2 and FIDO2 security devices suport for systemd.

Summary: Consider to add TPM2 and FIDO2 security devices suport for systemd.

Status:	CLOSED FIXED

Alias:	None

Product:	Sisyphus
Classification:	Development
Component:	systemd (show other bugs)
Version:	unstable
Hardware:	x86_64 Linux

Importance:	P5 enhancement
Assignee:	qa-team@altlinux.org
QA Contact:	qa-p10@altlinux.org

URL:
Keywords:

Depends on:
Blocks:

Reported:	2024-04-05 21:35 MSK by Constantin
Modified:	2026-10-06 19:46 MSK (History)
CC List:	4 users (show)

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description

Constantin 2024-04-05 21:35:06 MSK

It is possible to convert encrypted volume from LUKS1 to LUKS2 (but Calamares doesn't support this), using Live CD. 

It is impossible to use any of decryption factor other than password in Alt p10 platform for open LUKS2 container. 

Systemd (https://github.com/systemd/systemd/tree/v249) version 249 supports storing 
 LUKS (version 2) decryption keys directly in TPM2 module or in FIDO2 external USB device (such as Yubikey, or similar). 

I suggest that systemd in this case needs to be recompiled with TPM2 and FIDO support.

Now we have these options in systemd:

# systemd --version
systemd 249 (v249.17-alt2)
+PAM +AUDIT +SELINUX -APPARMOR +IMA +SMACK +SECCOMP +GCRYPT +GNUTLS +OPENSSL +ACL +BLKID +CURL +ELFUTILS -FIDO2 +IDN2 -IDN +IPTC +KMOD +LIBCRYPTSETUP +LIBFDISK +PCRE2 +PWQUALITY -P11KIT -QRENCODE +BZIP2 +LZ4 +XZ +ZLIB +ZSTD +XKBCOMMON +UTMP +SYSVINIT default-hierarchy=unified

# systemd-cryptenroll --tpm2-device=list
TPM2 not supported on this build.

As we can see there are no support for FIDO2 or TPM2 devices at all.

But in upstream release of systemd 249   (https://github.com/systemd/systemd/blob/v249/meson_options.txt) it has these supoort options:

...
option('libfido2', type : 'combo', choices : ['auto', 'true', 'false'],
       description : 'FIDO2 support')
option('tpm2', type : 'combo', choices : ['auto', 'true', 'false'],
       description : 'TPM2 support')

...

Consider to add support for FIDO2 and TPM2 security devices for systemd 249.

Comment 1

Alexander Makeenkov 2024-04-08 09:19:40 MSK

# rpm -q systemd && systemd-cryptenroll --tpm2-device=list
systemd-249.17-alt2.x86_64
TPM2 not supported on this build.

В сизифе не воспроизводится:

# rpm -q systemd && systemd-cryptenroll --tpm2-device=list
systemd-254.10-alt1.x86_64
No suitable TPM2 devices found.

Comment 2

Constantin 2024-04-09 09:06:52 MSK

In sysyphys we still can't use systemd to enroll LUKS2 keys into FIDO2 external device such as Yubikey\Rutoken MFA\Google Titan, etc:

# systemd --version
systemd 254 (254.10-alt1)
+PAM +AUDIT +SELINUX -APPARMOR +IMA +SMACK +SECCOMP +GCRYPT +GNUTLS +OPENSSL +ACL +BLKID +CURL +ELFUTILS -FIDO2 +IDN2 -IDN +IPTC +KMOD +LIBCRYPTSETUP +LIBFDISK +PCRE2 -PWQUALITY -P11KIT -QRENCODE +TPM2 +BZIP2 +LZ4 +XZ +ZLIB +ZSTD -BPF_FRAMEWORK +XKBCOMMON +UTMP +SYSVINIT default-hierarchy=unified

As we can see, systemd in sysyphus still has no support of FIDO2 devices. Almost any modern linux distro has this support now. Moreover, many distros suggest this support in two independent ways -- with systemd (modern way) and with special luks yubikey packages (legacy way).

Btw, original bug points mainly over P10 platform, not sysyphus.

Comment 3

Vera Blagoveschenskaya 2026-09-15 14:46:13 MSK

Результат проверки актуальности

Состояние:
В p10 systemd-249.17 без TPM2 и FIDO2. В Sisyphus systemd-260.4 TPM2 уже есть. Наличие FIDO2 в текущей сборке бумажно не подтверждено.

Рекомендация:
выполнить ретест systemd-cryptenroll --tpm2-device=list и поддержки FIDO2 на актуальном Sisyphus.

Comment 4

Vera Blagoveschenskaya 2026-10-06 19:21:10 MSK

Перепроверила в Sisyphus и p11 (Альт Сервер 11.1, обновлённый до ветки):
- Sisyphus: systemd-260.4-alt2, cryptsetup-2.8.4-alt1, libfido2_1-1.17.0-alt1;
- p11: systemd-257.9-alt1, cryptsetup-2.7.4-alt1, libfido2_1-1.16.0-alt6.

В обеих ветках systemd собран с поддержкой TPM2, FIDO2 и PKCS#11: systemctl --version показывает +TPM2 +FIDO2 +P11KIT +LIBCRYPTSETUP. Команды systemd-cryptenroll --tpm2-device=list, --fido2-device=list и --pkcs11-token-uri=list работают (без устройств отвечают «No suitable TPM2 devices found.», «No FIDO2 devices found.», «No suitable PKCS#11 tokens found.»), сообщения «TPM2 not supported on this build» больше нет.

TPM2 проверила на деле с программным TPM (swtpm через tpm_vtpm_proxy), по два раза в каждой ветке: LUKS2-контейнер, systemd-cryptenroll --unlock-key-file=... --tpm2-device=auto --tpm2-pcrs=7 добавляет слот с токеном systemd-tpm2, после чего systemd-cryptsetup attach с tpm2-device=auto открывает контейнер без пароля.

FIDO2 проверила только на уровне сборки и команд: физического FIDO2-ключа у меня нет, systemd-cryptenroll --fido2-device=auto без устройства отвечает «No FIDO devices found.».

В p10 (systemd-249.17-alt2), о котором шла речь в начале, не проверяла.

Comment 5

Constantin 2026-10-06 19:43:40 MSK

Thanks. 

My FIDO2 keys (both Yubikey 5 and Rutoken MFA) now owned by A.Shabalin or A.Cherepanov in Moscow's office. I gave both keys to them some time ago specially to help checking these options. And now those keys are belong to them.

Comment 6

Constantin 2026-10-06 19:46:18 MSK

Btw, in my opinion, Yubikey must be work fine. Instead of Rutoken MFA. Think, Rutoken has no hardware support in chipset to store LUKS decryption data.