From 2103038e57ee282adbab0ad99c559af944e11249 Mon Sep 17 00:00:00 2001
From: sarthurdev <965089+sarthurdev@users.noreply.github.com>
Date: Tue, 15 Jul 2025 12:59:18 +0200
Subject: tpm: T4919: Not supported on live-ISO

---
 src/helpers/vyos-config-encrypt.py | 5 +++++
 1 file changed, 5 insertions(+)

(limited to 'src')

diff --git a/src/helpers/vyos-config-encrypt.py b/src/helpers/vyos-config-encrypt.py
index 5f49ca119..9c35d90f5 100755
--- a/src/helpers/vyos-config-encrypt.py
+++ b/src/helpers/vyos-config-encrypt.py
@@ -23,6 +23,7 @@ from cryptography.fernet import Fernet
 from tempfile import NamedTemporaryFile
 from tempfile import TemporaryDirectory
 
+from vyos.system.image import is_live_boot
 from vyos.tpm import clear_tpm_key
 from vyos.tpm import read_tpm_key
 from vyos.tpm import write_tpm_key
@@ -199,6 +200,10 @@ if __name__ == '__main__':
         print("Must specify action.")
         sys.exit(1)
 
+    if is_live_boot():
+        print("Config encryption not available on live-ISO environment")
+        sys.exit(1)
+
     parser = ArgumentParser(description='Config encryption')
     parser.add_argument('--disable', help='Disable encryption', action="store_true")
     parser.add_argument('--enable', help='Enable encryption', action="store_true")
-- 
cgit v1.2.3


From 6c3efdc7c7d3c1e1e9f130bfb37c644e1ac0b4bf Mon Sep 17 00:00:00 2001
From: sarthurdev <965089+sarthurdev@users.noreply.github.com>
Date: Tue, 15 Jul 2025 13:21:54 +0200
Subject: tpm: T7628: Fix non-TPM backed encryption

---
 src/helpers/vyos-config-encrypt.py | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

(limited to 'src')

diff --git a/src/helpers/vyos-config-encrypt.py b/src/helpers/vyos-config-encrypt.py
index 9c35d90f5..b658b8f43 100755
--- a/src/helpers/vyos-config-encrypt.py
+++ b/src/helpers/vyos-config-encrypt.py
@@ -76,16 +76,17 @@ def load_config(key):
 
     return True
 
-def encrypt_config(key, recovery_key):
+def encrypt_config(key, recovery_key=None, is_tpm=True):
     if is_opened():
         raise Exception('An encrypted config volume is already mapped')
 
     # Clear and write key to TPM
-    try:
-        clear_tpm_key()
-    except:
-        pass
-    write_tpm_key(key)
+    if is_tpm:
+        try:
+            clear_tpm_key()
+        except:
+            pass
+        write_tpm_key(key)
 
     persist_path = cmd(persistpath_cmd).strip()
     size = ask_input('Enter size of encrypted config partition (MB): ', numeric_only=True, default=512)
@@ -268,7 +269,7 @@ if __name__ == '__main__':
             print('Backup the recovery key in a safe place!')
             print('Recovery key: ' + recovery_key.decode())
         elif args.enable:
-            encrypt_config(recovery_key)
+            encrypt_config(recovery_key, is_tpm=False)
 
             print('Encrypted config volume has been enabled without TPM')
             print('Backup the key in a safe place!')
-- 
cgit v1.2.3


From 1a22eacd20e74aa013ca95bc4442ad4475ea7675 Mon Sep 17 00:00:00 2001
From: sarthurdev <965089+sarthurdev@users.noreply.github.com>
Date: Tue, 15 Jul 2025 16:47:20 +0200
Subject: tpm: T4919: Add boot warning if TPM not present

---
 src/init/vyos-router | 7 +++++++
 1 file changed, 7 insertions(+)

(limited to 'src')

diff --git a/src/init/vyos-router b/src/init/vyos-router
index 563f12755..7a02ce564 100755
--- a/src/init/vyos-router
+++ b/src/init/vyos-router
@@ -97,6 +97,13 @@ mount_encrypted_config() {
                 return 0
             fi
 
+            if [ ! -e /sys/class/tpm/tpm0 ]; then
+                echo "WARN: TPM device not found, encrypted config volume will not be automatically mounted"
+                echo "Use 'encryption load' to load volume manually with a key"
+                echo "or 'encryption disable' to decrypt volume with a key"
+                return 1
+            fi
+
             vyos_tpm_key=$(python3 -c 'from vyos.tpm import read_tpm_key; print(read_tpm_key().decode())' 2>/dev/null)
             if [ $? -ne 0 ]; then
                 echo "ERROR: Failed to fetch encryption key from TPM. Encrypted config volume has not been mounted"
-- 
cgit v1.2.3