Public bug reported:
System: Ubuntu 26.04 LTS, gnome-remote-desktop 50.0-0ubuntu2, kernel
7.0.0-30-generic, Wayland/GDM, HP OMEN with Intel PTT firmware TPM
(/dev/tpm0 and /dev/tpmrm0 present).
STEPS TO REPRODUCE
1. Enable Settings > System > Remote Desktop > Remote Login.
2. sudo grdctl --system rdp set-credentials <user> <pass>
3. Reboot.
4. sudo grdctl --system status --show-credentials
EXPECTED
Credentials persist and RDP login screen is reachable on port 3389 after every
reboot.
ACTUAL
After every cold reboot, the daemon fails to load its credentials:
Failed to read credentials: Esys_ContextLoad failed:
tpm:parameter(1):integrity check failed
Remote Login is then unavailable until credentials are reset within the same
boot.
ROOT CAUSE
grd-credentials-tpm.c seals the system RDP credentials with the TPM using
Esys_CreatePrimary/Esys_CreateLoaded and stores the transient object context
in rdp-credentials.priv. Transient object contexts are tied to the boot and
do not survive a cold reboot, so Esys_ContextLoad fails with an integrity
check error. Same class of problem as tpm2-software/tpm2-tools#2088 / #3222.
WORKAROUND (confirmed working)
Force the daemon's documented GKeyFile fallback by hiding /dev/tpm*:
/etc/systemd/system/gnome-remote-desktop.service.d/disable-tpm.conf
[Service]
PrivateDevices=yes
The daemon then logs "Init TPM credentials failed because no TPM device
found, using GKeyFile as fallback" and credentials survive reboots.
SUGGESTED FIX
grd-credentials-tpm.c should not depend on transient object contexts that
invalidate on reboot. Consider sealing with a persistent primary key
(Esys_CreatePersistent / Esys_EvictControl) or wrapping the secret with a
persistent key, so sealed credentials remain loadable across reboots.
APPORT ATTACHED for environment details.
** Affects: gnome-remote-desktop (Ubuntu)
Importance: Undecided
Status: New
** Attachment added: "grd-tpm-bug-apport.txt"
https://bugs.launchpad.net/bugs/2164534/+attachment/5993515/+files/grd-tpm-bug-apport.txt
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2164534
Title:
Remote Login stops working after every reboot on TPM-equipped
machines: "Couldn't retrieve RDP credentials: Esys_ContextLoad failed:
tpm:parameter(1):integrity check failed"
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/gnome-remote-desktop/+bug/2164534/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
