** Description changed: System: Ubuntu 26.04 LTS, gnome-remote-desktop 50.0-0ubuntu2, kernel 7.0.0-30-generic, Wayland/GDM, HP OMEN with Intel PTT firmware TPM (/dev/tpm0 and /dev/tpmrm0 present). STEPS TO REPRODUCE 1. Enable Settings > System > Remote Desktop > Remote Login. 2. sudo grdctl --system rdp set-credentials <user> <pass> 3. Reboot. 4. sudo grdctl --system status --show-credentials EXPECTED Credentials persist and RDP login screen is reachable on port 3389 after every reboot. ACTUAL After every cold reboot, the daemon fails to load its credentials: - Failed to read credentials: Esys_ContextLoad failed: - tpm:parameter(1):integrity check failed + Failed to read credentials: Esys_ContextLoad failed: + tpm:parameter(1):integrity check failed Remote Login is then unavailable until credentials are reset within the same boot. ROOT CAUSE grd-credentials-tpm.c seals the system RDP credentials with the TPM using Esys_CreatePrimary/Esys_CreateLoaded and stores the transient object context in rdp-credentials.priv. Transient object contexts are tied to the boot and do not survive a cold reboot, so Esys_ContextLoad fails with an integrity check error. Same class of problem as tpm2-software/tpm2-tools#2088 / #3222. WORKAROUND (confirmed working) Force the daemon's documented GKeyFile fallback by hiding /dev/tpm*: - /etc/systemd/system/gnome-remote-desktop.service.d/disable-tpm.conf - [Service] - PrivateDevices=yes + /etc/systemd/system/gnome-remote-desktop.service.d/disable-tpm.conf + [Service] + PrivateDevices=yes The daemon then logs "Init TPM credentials failed because no TPM device found, using GKeyFile as fallback" and credentials survive reboots. SUGGESTED FIX grd-credentials-tpm.c should not depend on transient object contexts that invalidate on reboot. Consider sealing with a persistent primary key (Esys_CreatePersistent / Esys_EvictControl) or wrapping the secret with a - persistent key, so sealed credentials remain loadable across reboots. If a - persistent object cannot be created, fall back to the GKeyFile storage. + persistent key, so sealed credentials remain loadable across reboots. APPORT ATTACHED for environment details.
-- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2164534 Title: Remote Login stops working after every reboot on TPM-equipped machines: "Couldn't retrieve RDP credentials: Esys_ContextLoad failed: tpm:parameter(1):integrity check failed" To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/gnome-remote-desktop/+bug/2164534/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
