# TPM2 LUKS Unlock not working

**URL:** https://discourse.nixosstag.fcio.net/t/tpm2-luks-unlock-not-working/52342
**Category:** Help
**Created:** [September 18, 2024, 5:13pm UTC](https://discourse.nixosstag.fcio.net/t/tpm2-luks-unlock-not-working/52342 "2024-09-18T17:13:59Z")
**Posts on this page:** 7
**Page:** 1

<div class="post-metadata">

### Author: ![Xelef2000](https://discourse.nixosstag.fcio.net/user_avatar/discourse.nixosstag.fcio.net/xelef2000/32/27384_2.png) [@Xelef2000](https://discourse.nixosstag.fcio.net/u/Xelef2000)
#### Post date: [September 18, 2024, 5:13pm UTC](https://discourse.nixosstag.fcio.net/t/tpm2-luks-unlock-not-working/52342/1 "2024-09-18T17:13:59Z")

</div>

I tried [this guide](https://discourse.nixosstag.fcio.net/t/full-disk-encryption-tpm2/29454) to enable tpm2 unlock but it didn’t work for me.  
I also searched the forum for other tpm2 post but wasn’t able to find a solution.  
[configuration.nix](https://github.com/Xelef2000/nixos-system-config/blob/d0628ab390a3bf3778d176956f94b9d6eef2ffc2/hosts/x2/configuration.nix), [hardware-configuration.nix](https://github.com/Xelef2000/nixos-system-config/blob/d0628ab390a3bf3778d176956f94b9d6eef2ffc2/hosts/x2/hardware-configuration.nix), [secure-boot.nix](https://github.com/Xelef2000/nixos-system-config/blob/d0628ab390a3bf3778d176956f94b9d6eef2ffc2/base/secure-boot.nix)  
The command I used to enroll was:

```auto
sudo systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=0+7 /dev/nvme0n1ps

```

Relevant sections:

```auto
  boot.initrd.availableKernelModules = ["tpm_tis" "xhci_pci" "thunderbolt" "vmd" "nvme" "usb_storage" "sd_mod"];
  boot.initrd.kernelModules = [];
  boot.kernelModules = ["kvm-intel"];
  boot.extraModulePackages = [];

  boot.initrd.systemd.enable = true;
  boot.initrd.systemd.enableTpm2 = true;
  security.tpm2.enable = true;

{ pkgs, lib, ... }:

{
  environment.systemPackages = with pkgs; [
    # For debugging and troubleshooting Secure Boot.
    sbctl
    # This is needed to auto-unlock LUKS with TPM 2 - https://discourse.nixosstag.fcio.net/t/full-disk-encryption-tpm2/29454/2
    tpm2-tss
  ];

  boot = {
    loader = {
      # Lanzaboote currently replaces the systemd-boot module.
      # This setting is usually set to true in configuration.nix
      # generated at installation time. So we force it to false
      # for now.
      systemd-boot.enable = lib.mkForce false;
      efi.canTouchEfiVariables = true;
      timeout = 1;
    };

    lanzaboote = {
      enable = true;
      pkiBundle = "/etc/secureboot";
    };

    # This is needed to auto-unlock LUKS with TPM 2 - https://discourse.nixosstag.fcio.net/t/full-disk-encryption-tpm2/29454/2
    initrd.systemd.enable = true;

  };
}

```

---

<div class="post-metadata">

### Author: ![FStefanni](https://discourse.nixosstag.fcio.net/user_avatar/discourse.nixosstag.fcio.net/fstefanni/32/9770_2.png) [@FStefanni](https://discourse.nixosstag.fcio.net/u/FStefanni)
#### Post date: [September 19, 2024, 6:15am UTC](https://discourse.nixosstag.fcio.net/t/tpm2-luks-unlock-not-working/52342/2 "2024-09-19T06:15:36Z")

</div>

Hi,

not an expert, but this worked for me:

```nix
  # Bootloader.
  boot.loader.systemd-boot.enable = true;
  boot.loader.efi.efiSysMountPoint = "/boot";
  boot.loader.efi.canTouchEfiVariables = true;
  boot.initrd.systemd.enable = true;

  boot.initrd.luks.devices = {
    cryptroot = {
       device = "/dev/disk/by-partuuid/${partitionuuid}";
       allowDiscards = true; # Used if primary device is a SSD
       preLVM = true;
    };
  };

  environment.systemPackages = with pkgs; [
    sbctl
    tpm2-tools
    tpm2-tss
  ];

```

Maybe avoid lanzaboote?

Regards

---

<div class="post-metadata">

### Author: ![ElvishJerricco](https://discourse.nixosstag.fcio.net/user_avatar/discourse.nixosstag.fcio.net/elvishjerricco/32/984_2.png) [@ElvishJerricco](https://discourse.nixosstag.fcio.net/u/ElvishJerricco)
#### Post date: [September 19, 2024, 7:21am UTC](https://discourse.nixosstag.fcio.net/t/tpm2-luks-unlock-not-working/52342/3 "2024-09-19T07:21:37Z")

</div>

FYI to both of you, nothing in `environment.systemPackages` has anything to do with TPM2 disk unlocking. And @FStefanni lanzaboote should be just fine with the TPM2, and `preLVM` has no effect with systemd-initrd.

I helped someone diagnose why their system stopped working with TPM2 auto-unlocking last night, and I believe we’ve identified a NixOS bug that’s appeared recently. I’m going to be opening a PR with a fix, a bit of code cleanup, and some improved documentation here very soon.

In the meantime, the other person’s fix was to include some new systemd dependencies. This is what I’ll be upstreaming to NixOS in the next day hopefully.

```
boot.initrd.systemd = {
  additionalUpstreamUnits = ["systemd-tpm2-setup-early.service"];
  storePaths = [
    "${config.boot.initrd.systemd.package}/lib/systemd/systemd-tpm2-setup"
    "${config.boot.initrd.systemd.package}/lib/systemd/system-generators/systemd-tpm2-generator"
  ];
};

```

---

<div class="post-metadata">

### Author: ![Xelef2000](https://discourse.nixosstag.fcio.net/user_avatar/discourse.nixosstag.fcio.net/xelef2000/32/27384_2.png) [@Xelef2000](https://discourse.nixosstag.fcio.net/u/Xelef2000)
#### Post date: [September 19, 2024, 8:26am UTC](https://discourse.nixosstag.fcio.net/t/tpm2-luks-unlock-not-working/52342/4 "2024-09-19T08:26:48Z")

</div>

Thank you, this solved my issue.

---

<div class="post-metadata">

### Author: ![uhlajs](https://discourse.nixosstag.fcio.net/user_avatar/discourse.nixosstag.fcio.net/uhlajs/32/28834_2.png) [@uhlajs](https://discourse.nixosstag.fcio.net/u/uhlajs)
#### Post date: [October 16, 2024, 9:37pm UTC](https://discourse.nixosstag.fcio.net/t/tpm2-luks-unlock-not-working/52342/5 "2024-10-16T21:37:37Z")

</div>

@ElvishJerricco Can you please link here the PR or the Issue? Also how do you debug these issues? Sorry for dummy question, but how can I obtain logs from initrd systemd?

---

<div class="post-metadata">

### Author: ![ElvishJerricco](https://discourse.nixosstag.fcio.net/user_avatar/discourse.nixosstag.fcio.net/elvishjerricco/32/984_2.png) [@ElvishJerricco](https://discourse.nixosstag.fcio.net/u/ElvishJerricco)
#### Post date: [October 16, 2024, 9:43pm UTC](https://discourse.nixosstag.fcio.net/t/tpm2-luks-unlock-not-working/52342/6 "2024-10-16T21:43:18Z")

</div>

> <https://github.com/NixOS/nixpkgs/pull/343307>
>
> \## Description of changes
> 
> Turns out there's some inconsistent behavior with t…he TPM2. This fixes some ordering bugs.
> 
> \## Things done
> 
> 
> 
> \- Built on platform(s)
> - \[x\] x86\_64-linux
> - \[\] aarch64-linux
> - \[\] x86\_64-darwin
> - \[\] aarch64-darwin
> \- For non-Linux: Is sandboxing enabled in \`nix.conf\`? (See \[Nix manual\](https://nixos.org/manual/nix/stable/command-ref/conf-file.html))
> - \[\] \`sandbox = relaxed\`
> - \[\] \`sandbox = true\`
> \- \[\] Tested, as applicable:
> - \[NixOS test(s)\](https://nixos.org/manual/nixos/unstable/index.html#sec-nixos-tests) (look inside \[nixos/tests\](https://github.com/NixOS/nixpkgs/blob/master/nixos/tests))
> - and/or \[package tests\](https://github.com/NixOS/nixpkgs/blob/master/pkgs/README.md#package-tests)
> - or, for functions and "core" functionality, tests in \[lib/tests\](https://github.com/NixOS/nixpkgs/blob/master/lib/tests) or \[pkgs/test\](https://github.com/NixOS/nixpkgs/blob/master/pkgs/test)
> - made sure NixOS tests are \[linked\](https://github.com/NixOS/nixpkgs/blob/master/pkgs/README.md#linking-nixos-module-tests-to-a-package) to the relevant packages
> \- \[\] Tested compilation of all packages that depend on this change using \`nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD"\`. Note: all changes have to be committed, also see \[nixpkgs-review usage\](https://github.com/Mic92/nixpkgs-review#usage)
> \- \[\] Tested basic functionality of all binary files (usually in \`./result/bin/\`)
> \- \[24.11 Release Notes\](https://github.com/NixOS/nixpkgs/blob/master/nixos/doc/manual/release-notes/rl-2411.section.md) (or backporting \[23.11\](https://github.com/NixOS/nixpkgs/blob/master/nixos/doc/manual/release-notes/rl-2311.section.md) and \[24.05\](https://github.com/NixOS/nixpkgs/blob/master/nixos/doc/manual/release-notes/rl-2405.section.md) Release notes)
> - \[\] (Package updates) Added a release notes entry if the change is major or breaking
> - \[\] (Module updates) Added a release notes entry if the change is significant
> - \[\] (Module addition) Added a release notes entry if adding a new NixOS module
> \- \[\] Fits \[CONTRIBUTING.md\](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md).
> 
> \<!--
> To help with the large amounts of pull requests, we would appreciate your
> reviews of other pull requests, especially simple package updates. Just leave a
> comment describing what you have tested in the relevant package/service.
> Reviewing helps to reduce the average time-to-merge for everyone.
> Thanks a lot if you do!
> 
> List of open PRs: https://github.com/NixOS/nixpkgs/pulls
> Reviewing guidelines: https://github.com/NixOS/nixpkgs/blob/master/pkgs/README.md#reviewing-contributions
> \--\>
> 
> \---
> 
> Add a :+1: \[reaction\] to \[pull requests you find important\].
> 
> \[reaction\]: https://github.blog/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/
> \[pull requests you find important\]: https://github.com/NixOS/nixpkgs/pulls?q=is%3Aopen+sort%3Areactions-%2B1-desc

---

<div class="post-metadata">

### Author: ![dinvlad](https://discourse.nixosstag.fcio.net/letter_avatar_proxy/v4/letter/d/858c86/32.png) [@dinvlad](https://discourse.nixosstag.fcio.net/u/dinvlad)
#### Post date: [October 18, 2024, 4:17pm UTC](https://discourse.nixosstag.fcio.net/t/tpm2-luks-unlock-not-working/52342/7 "2024-10-18T16:17:18Z")

</div>

> [@FStefanni](#):
>
> `boot.initrd.systemd.enable = true;`

Just wanted to say thanks, this line was what did the trick for me. The only other things I did earlier were 1) `systemd-cryptenroll` command from above and 2) add `crypttabExtraOpts = ["tpm2-device=auto"];` in Disko. I have removed all the other tpm2\* related settings (incl. kernel modules and packages) from `configuration.nix`, and it still works now!