** Description changed:

  System: Ubuntu 26.04 LTS, gnome-remote-desktop 50.0-0ubuntu2, kernel
  7.0.0-30-generic, Wayland/GDM, HP OMEN with Intel PTT firmware TPM
  (/dev/tpm0 and /dev/tpmrm0 present).
  
  STEPS TO REPRODUCE
  1. Enable Settings > System > Remote Desktop > Remote Login.
  2. sudo grdctl --system rdp set-credentials <user> <pass>
  3. Reboot.
  4. sudo grdctl --system status --show-credentials
  
  EXPECTED
  Credentials persist and RDP login screen is reachable on port 3389 after 
every reboot.
  
  ACTUAL
  After every cold reboot, the daemon fails to load its credentials:
-   Failed to read credentials: Esys_ContextLoad failed:
-   tpm:parameter(1):integrity check failed
+   Failed to read credentials: Esys_ContextLoad failed:
+   tpm:parameter(1):integrity check failed
  Remote Login is then unavailable until credentials are reset within the same 
boot.
  
  ROOT CAUSE
  grd-credentials-tpm.c seals the system RDP credentials with the TPM using
  Esys_CreatePrimary/Esys_CreateLoaded and stores the transient object context
  in rdp-credentials.priv. Transient object contexts are tied to the boot and
  do not survive a cold reboot, so Esys_ContextLoad fails with an integrity
  check error. Same class of problem as tpm2-software/tpm2-tools#2088 / #3222.
  
  WORKAROUND (confirmed working)
  Force the daemon's documented GKeyFile fallback by hiding /dev/tpm*:
-   /etc/systemd/system/gnome-remote-desktop.service.d/disable-tpm.conf
-   [Service]
-   PrivateDevices=yes
+   /etc/systemd/system/gnome-remote-desktop.service.d/disable-tpm.conf
+   [Service]
+   PrivateDevices=yes
  The daemon then logs "Init TPM credentials failed because no TPM device
  found, using GKeyFile as fallback" and credentials survive reboots.
  
  SUGGESTED FIX
  grd-credentials-tpm.c should not depend on transient object contexts that
  invalidate on reboot. Consider sealing with a persistent primary key
  (Esys_CreatePersistent / Esys_EvictControl) or wrapping the secret with a
- persistent key, so sealed credentials remain loadable across reboots. If a
- persistent object cannot be created, fall back to the GKeyFile storage.
+ persistent key, so sealed credentials remain loadable across reboots.
  
  APPORT ATTACHED for environment details.

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2164534

Title:
  Remote Login stops working after every reboot on TPM-equipped
  machines: "Couldn't retrieve RDP credentials: Esys_ContextLoad failed:
  tpm:parameter(1):integrity check failed"

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/gnome-remote-desktop/+bug/2164534/+subscriptions


-- 
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

Reply via email to