diff options
| author | Daniil Baturin <daniil@vyos.io> | 2025-07-29 15:53:56 +0100 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2025-07-29 15:53:56 +0100 |
| commit | a551fa45573ef57858904773d4bcc99dbf553b19 (patch) | |
| tree | 23d14c90dd78832d4b8482c115784cac042de72a /src/init | |
| parent | 51a17eadc063423a80502462dba0b67cb4fe3496 (diff) | |
| parent | 1a22eacd20e74aa013ca95bc4442ad4475ea7675 (diff) | |
| download | vyos-1x-a551fa45573ef57858904773d4bcc99dbf553b19.tar.gz vyos-1x-a551fa45573ef57858904773d4bcc99dbf553b19.zip | |
Merge pull request #4627 from sarthurdev/T7628
T7628: Fix non-TPM backed config encryption
Diffstat (limited to 'src/init')
| -rwxr-xr-x | src/init/vyos-router | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/src/init/vyos-router b/src/init/vyos-router index 563f12755..7a02ce564 100755 --- a/src/init/vyos-router +++ b/src/init/vyos-router @@ -97,6 +97,13 @@ mount_encrypted_config() { return 0 fi + if [ ! -e /sys/class/tpm/tpm0 ]; then + echo "WARN: TPM device not found, encrypted config volume will not be automatically mounted" + echo "Use 'encryption load' to load volume manually with a key" + echo "or 'encryption disable' to decrypt volume with a key" + return 1 + fi + vyos_tpm_key=$(python3 -c 'from vyos.tpm import read_tpm_key; print(read_tpm_key().decode())' 2>/dev/null) if [ $? -ne 0 ]; then echo "ERROR: Failed to fetch encryption key from TPM. Encrypted config volume has not been mounted" |