Merge pull request #4627 from sarthurdev/T7628

T7628: Fix non-TPM backed config encryption

2 files changed, 20 insertions, 7 deletions

diff --git a/src/helpers/vyos-config-encrypt.py b/src/helpers/vyos-config-encrypt.py
index 5f49ca119..b658b8f43 100755
--- a/src/helpers/vyos-config-encrypt.py
+++ b/src/helpers/vyos-config-encrypt.py
@@ -23,6 +23,7 @@ from cryptography.fernet import Fernet
 from tempfile import NamedTemporaryFile
 from tempfile import TemporaryDirectory
 
+from vyos.system.image import is_live_boot
 from vyos.tpm import clear_tpm_key
 from vyos.tpm import read_tpm_key
 from vyos.tpm import write_tpm_key
@@ -75,16 +76,17 @@ def load_config(key):
 
     return True
 
-def encrypt_config(key, recovery_key):
+def encrypt_config(key, recovery_key=None, is_tpm=True):
     if is_opened():
         raise Exception('An encrypted config volume is already mapped')
 
     # Clear and write key to TPM
-    try:
-        clear_tpm_key()
-    except:
-        pass
-    write_tpm_key(key)
+    if is_tpm:
+        try:
+            clear_tpm_key()
+        except:
+            pass
+        write_tpm_key(key)
 
     persist_path = cmd(persistpath_cmd).strip()
     size = ask_input('Enter size of encrypted config partition (MB): ', numeric_only=True, default=512)
@@ -199,6 +201,10 @@ if __name__ == '__main__':
         print("Must specify action.")
         sys.exit(1)
 
+    if is_live_boot():
+        print("Config encryption not available on live-ISO environment")
+        sys.exit(1)
+
     parser = ArgumentParser(description='Config encryption')
     parser.add_argument('--disable', help='Disable encryption', action="store_true")
     parser.add_argument('--enable', help='Enable encryption', action="store_true")
@@ -263,7 +269,7 @@ if __name__ == '__main__':
             print('Backup the recovery key in a safe place!')
             print('Recovery key: ' + recovery_key.decode())
         elif args.enable:
-            encrypt_config(recovery_key)
+            encrypt_config(recovery_key, is_tpm=False)
 
             print('Encrypted config volume has been enabled without TPM')
             print('Backup the key in a safe place!')
diff --git a/src/init/vyos-router b/src/init/vyos-router
index 563f12755..7a02ce564 100755
--- a/src/init/vyos-router
+++ b/src/init/vyos-router
@@ -97,6 +97,13 @@ mount_encrypted_config() {
                 return 0
             fi
 
+            if [ ! -e /sys/class/tpm/tpm0 ]; then
+                echo "WARN: TPM device not found, encrypted config volume will not be automatically mounted"
+                echo "Use 'encryption load' to load volume manually with a key"
+                echo "or 'encryption disable' to decrypt volume with a key"
+                return 1
+            fi
+
             vyos_tpm_key=$(python3 -c 'from vyos.tpm import read_tpm_key; print(read_tpm_key().decode())' 2>/dev/null)
             if [ $? -ne 0 ]; then
                 echo "ERROR: Failed to fetch encryption key from TPM. Encrypted config volume has not been mounted"