Comment corriger tpm2_ptool: Failed to open specified TCTI device file /dev/tpmrm0: Permission denied

Problème

En exécutant tpm2_tool init ou une commande similaire, vous voyez le message d’erreur suivant

tpm2_permission_error.txt

Traceback (most recent call last):
  File "/usr/lib/python3/dist-packages/tpm2_pkcs11/commandlets_store.py", line 100, in __call__
    pobj_ctx = create_primary(tpm2, hierarchyauth, pobjauth, transient_parent)
  File "/usr/lib/python3/dist-packages/tpm2_pkcs11/utils.py", line 430, in create_primary
    return tpm2.createprimary(hierarchyauth, pobjauth, alg=alg, attrs=attrs)
  File "/usr/lib/python3/dist-packages/tpm2_pkcs11/tpm2.py", line 86, in createprimary
    raise RuntimeError("Could not execute tpm2_createprimary: %s" %
RuntimeError: Could not execute tpm2_createprimary: b'ERROR:tcti:src/tss2-tcti/tcti-device.c:452:Tss2_Tcti_Device_Init() Failed to open specified TCTI device file /dev/tpmrm0: Permission denied \nERROR:tcti:src/tss2-tcti/tctildr-dl.c:154:tcti_from_file() Could not initialize TCTI file: libtss2-tcti-device.so.0 \nERROR:tcti:src/tss2-tcti/tcti-device.c:452:Tss2_Tcti_Device_Init() Failed to open specified TCTI device file /dev/tpm0: Permission denied \nERROR:tcti:src/tss2-tcti/tctildr-dl.c:154:tcti_from_file() Could not initialize TCTI file: libtss2-tcti-device.so.0 \nWARNING:tcti:src/util/io.c:262:socket_connect() Failed to connect to host 127.0.0.1, port 2321: errno 111: Connection refused \nERROR:tcti:src/tss2-tcti/tcti-swtpm.c:614:Tss2_Tcti_Swtpm_Init() Cannot connect to swtpm TPM socket \nERROR:tcti:src/tss2-tcti/tctildr-dl.c:154:tcti_from_file() Could not initialize TCTI file: libtss2-tcti-swtpm.so.0 \nWARNING:tcti:src/util/io.c:262:socket_connect() Failed to connect to host 127.0.0.1, port 2321: errno 111: Connection refused \nERROR:tcti:src/tss2-tcti/tctildr-dl.c:154:tcti_from_file() Could not initialize TCTI file: libtss2-tcti-mssim.so.0 \nERROR:tcti:src/tss2-tcti/tctildr-dl.c:254:tctildr_get_default() No standard TCTI could be loaded \nERROR:tcti:src/tss2-tcti/tctildr.c:428:Tss2_TctiLdr_Initialize_Ex() Failed to instantiate TCTI \nERROR: Could not load tcti, got: "(null)"\n'
Could not execute tpm2_createprimary: b'ERROR:tcti:src/tss2-tcti/tcti-device.c:452:Tss2_Tcti_Device_Init() Failed to open specified TCTI device file /dev/tpmrm0: Permission denied \nERROR:tcti:src/tss2-tcti/tctildr-dl.c:154:tcti_from_file() Could not initialize TCTI file: libtss2-tcti-device.so.0 \nERROR:tcti:src/tss2-tcti/tcti-device.c:452:Tss2_Tcti_Device_Init() Failed to open specified TCTI device file /dev/tpm0: Permission denied \nERROR:tcti:src/tss2-tcti/tctildr-dl.c:154:tcti_from_file() Could not initialize TCTI file: libtss2-tcti-device.so.0 \nWARNING:tcti:src/util/io.c:262:socket_connect() Failed to connect to host 127.0.0.1, port 2321: errno 111: Connection refused \nERROR:tcti:src/tss2-tcti/tcti-swtpm.c:614:Tss2_Tcti_Swtpm_Init() Cannot connect to swtpm TPM socket \nERROR:tcti:src/tss2-tcti/tctildr-dl.c:154:tcti_from_file() Could not initialize TCTI file: libtss2-tcti-swtpm.so.0 \nWARNING:tcti:src/util/io.c:262:socket_connect() Failed to connect to host 127.0.0.1, port 2321: errno 111: Connection refused \nERROR:tcti:src/tss2-tcti/tctildr-dl.c:154:tcti_from_file() Could not initialize TCTI file: libtss2-tcti-mssim.so.0 \nERROR:tcti:src/tss2-tcti/tctildr-dl.c:254:tctildr_get_default() No standard TCTI could be loaded \nERROR:tcti:src/tss2-tcti/tctildr.c:428:Tss2_TctiLdr_Initialize_Ex() Failed to instantiate TCTI \nERROR: Could not load tcti, got: "(null)"\n'

Solution

Votre utilisateur actuel n’a pas les permissions nécessaires pour accéder au périphérique TPM. Vous pouvez corriger cela en ajoutant votre utilisateur au groupe tss :

add_user_to_tss_group.sh

sudo usermod -a -G tss $USER

Ce changement ne prendra pas effet tant que vous ne vous déconnectez et reconnectez pas (ou redémarrez).

Afin de le faire fonctionner maintenant, vous pouvez aussi exécuter la commande en tant que root :

run_tpm2_tool_as_root.sh

sudo tpm2_ptool init