Arch Linux

mesaprotector

Member

Registered: 2024-03-03

Posts: 202

Fixing iwd encrypted profiles after mkinitcpio v42/TPM changes

Hello all,
Ages ago (nearly two years now), I followed the wiki's suggestion to encrypt network profiles using systemd-creds.

Recently, thanks to the changes with mkinitcpio and systemd-pcrosseparator.service, if I upgrade to mkinitcpio v42 I have no internet. iwd actually fails to load entirely:

Sep 20 13:21:52 Marojejy systemd-creds[1170]: TPM policy does not match current system state. Either system has been tampered with or policy out-of-date: Operation not permitted
Sep 20 13:21:52 Marojejy (iwd)[1138]: iwd.service: Unexpected TPM PCR state of the system.
Sep 20 13:21:52 Marojejy (iwd)[1138]: iwd.service: Failed to set up credentials: Structure needs cleaning
Sep 20 13:21:52 Marojejy (iwd)[1138]: iwd.service: Failed at step CREDENTIALS spawning /usr/lib/iwd/iwd: Structure needs cleaning
Sep 20 13:21:52 Marojejy systemd[1]: iwd.service: Main process exited, code=exited, status=243/CREDENTIALS
Sep 20 13:21:52 Marojejy systemd[1]: iwd.service: Failed with result 'exit-code'.
Sep 20 13:21:52 Marojejy systemd[1]: Failed to start Wireless service.

Most of the hastily put-together tutorials on how to fix your system after the TPM key changes deal with setups where the TPM key is used to unlock a LUKS volume (which is reasonable as that's by far the most common use case). However none of it seems very applicable to my situation.

It is my impression that I have to decrypt my network profiles, then re-do the process. On kernel.org there is a page supposedly explaining the process. Unfortunately this depends on iwd-decrypt-profile and this tool is not included in my install; it is available in a git repository only in C program form and I am not familiar enough with C compilation to get it to compile. Even re-compiling iwd with the --enable-tools option which would seem to have been made for this purpose doesn't seem to do anything. There is a cryptic comment on the iwd README page regarding --enable-tools:

"This enables building of all utilities that are however
        not installed and only useful during development."

Why in the world would you have an option that doesn't install anything? Is it common practice to provide off-by-default build time options that don't do anything at run time? Admittedly I don't often mess with compilation options (the occasional suckless program mainly).

My Plan B is just to accept that all my profiles will soon be lost forever and re-do the encryption process as I am already planning to buy a new router at the start of next week. Still it would be nice if I could find a way to save them.

If anyone else had tried this setup and is dealing with the same issue I would love to hear solutions. Or at least commiserate. I figure that getting iwd-decrypt-profile.c to compile is probably easy enough and would warrant a thread in Newbie Corner, but am posting here in case any of my assumptions are very wrong for a seemingly uncommon case.

Last edited by mesaprotector (Yesterday 04:39:56)

Beemo

Member

Registered: 2024-12-20

Posts: 153

Re: Fixing iwd encrypted profiles after mkinitcpio v42/TPM changes

I've never done this before but I'm guessing 2 options:
1. Downgrade mkinitcpio (to restore the old PCRs) and "systemd-creds decrypt /etc/credstore.encrypted/iwd-secret.cred"
2. The wiki says:

# systemd-ask-password -n | systemd-creds --tpm2-device=auto --name=iwd-secret encrypt - /etc/credstore.encrypted/iwd-secret.cred

Doesn't this just encrypt a password you typed? If you know the password you might be able to just give iwd that somehow.

Last edited by Beemo (Yesterday 05:06:28)

mesaprotector

Member

Registered: 2024-03-03

Posts: 202

Re: Fixing iwd encrypted profiles after mkinitcpio v42/TPM changes

That is indeed a way to get the password back, but as far as I am aware the only way to give iwd the password is iwd-decrypt-profile, which I don't know how to compile.

Beemo

Member

Registered: 2024-12-20

Posts: 153

Re: Fixing iwd encrypted profiles after mkinitcpio v42/TPM changes

[Service]
LoadCredentialEncrypted=iwd-secret:/etc/credstore.encrypted/iwd-secret.cred

Wouldn't you be able to change this to the below (if you know the password)?

[Service]
LoadCredential=iwd-secret:/etc/credstore/iwd-secret.cred

That said, seems to me that, since what you gave to iwd is just a password, you can just encrypted a new file with the same password and delete the old one.

$ cp /etc/credstore.encrypted/iwd-secret.cred ~
# systemd-ask-password -n | systemd-creds --tpm2-device=auto --name=iwd-secret encrypt - /etc/credstore.encrypted/iwd-secret.cred
(type the same password here)

cryptearth

Member

Registered: 2024-02-03

Posts: 2,341

Re: Fixing iwd encrypted profiles after mkinitcpio v42/TPM changes

git clone https://gitlab.archlinux.org/archlinux/packaging/packages/iwd.git
cd iwd

then edit the PKGBUILD and change

--disable-tools

to

--enable-tools

and bump the pkgrel +1
and then run

makepkg -s --skippgpcheck

then install the resulting package with

pacman -U iwd.pkg

there's no magic to it

hint: of course git and base-devel needs to be installed as deps
hint hint: the --skippgpcheck is because i'm lazy and don't know how to deal with pgp (I'm not against the standard of OpenPGP - but i'm against devs practices of GnuPG - mostly thier "if you want to use OpenPGP you HAVE TO use GnuPG - or not pgp at all")

or maybe request some of the trusted maintainers to provide you a pre-built package with the tools enabled

Last edited by cryptearth (Today 05:24:21)