diff options
| author | sarthurdev <965089+sarthurdev@users.noreply.github.com> | 2025-08-19 12:53:47 +0200 |
|---|---|---|
| committer | sarthurdev <965089+sarthurdev@users.noreply.github.com> | 2025-09-23 21:25:26 +0200 |
| commit | 645f92140138623c81fe7922978e8298301e7be1 (patch) | |
| tree | 8239f102020453e6e852d16487b44f15dceea1a2 /src | |
| parent | b7c8955e3a96f9b016bc3c595d33e6ace2872af4 (diff) | |
| download | vyos-1x-645f92140138623c81fe7922978e8298301e7be1.tar.gz vyos-1x-645f92140138623c81fe7922978e8298301e7be1.zip | |
tpm: T7735: Only require key/recovery if unmapped
Diffstat (limited to 'src')
| -rwxr-xr-x | src/helpers/vyos-config-encrypt.py | 25 |
1 files changed, 13 insertions, 12 deletions
diff --git a/src/helpers/vyos-config-encrypt.py b/src/helpers/vyos-config-encrypt.py index d76baa87c..d9cf98cb9 100755 --- a/src/helpers/vyos-config-encrypt.py +++ b/src/helpers/vyos-config-encrypt.py @@ -251,18 +251,19 @@ if __name__ == '__main__': question_key_str = 'recovery key' if tpm_exists else 'key' - if tpm_exists: - if args.enable: - key = Fernet.generate_key() - elif args.disable or args.load: - try: - key = read_tpm_key() - need_recovery = False - except: - print('Failed to read key from TPM, recovery key required') - need_recovery = True - else: - need_recovery = True + if not is_opened(): + if tpm_exists: + if args.enable: + key = Fernet.generate_key() + elif args.disable or args.load: + try: + key = read_tpm_key() + need_recovery = False + except: + print('Failed to read key from TPM, recovery key required') + need_recovery = True + else: + need_recovery = True if args.enable and not tpm_exists: print('WARNING: VyOS will boot into a default config when encrypted without a TPM') |