godaddy / godaddy/sshenc

Prebuilt Linux binary does not appear to include TPM support

Open Beginner friendly
#256 0 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
Rust
Stars
25
Forks
1
PR merge metrics
No merged PRs in 30d

Description

## Description

Hi.
I'm testing sshenc on Linux with a TPM 2.0, but sshenc agent fails with this error: `Error: failed to initialize backend: hardware security module not available`

Looking at [hardware-enclave](https://github.com/godaddy/hardware-enclave/blob/main/crates/hardware-enclave/Cargo.toml#L93) , Linux TPM support is disabled by default:
```
# ── linux-tpm: opt-in native Linux TPM 2.0 backend (requires libtss2).
# Off by default since most Linux consumers use the keyring backend or the
# WSL→Windows bridge. Enable explicitly when native TPM 2.0 is required.
linux-tpm = []
```

However, this feature is not enabled in [cargo config](https://github.com/godaddy/sshenc/blob/v0.6.101/Cargo.toml#L33):
```
hardware-enclave = { version = "0.2.5", features = ["signing", "encryption"] }
```

## Steps to Reproduce
```
# sshenc agent
Error: failed to initialize backend: hardware security module not available

# sshenc --version
sshenc 0.6.101

# file /usr/local/bin/sshenc
/usr/local/bin/sshenc: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 3.2.0, BuildID[sha1]=cf0708a018d73a1575cea13ccf39fcdcbf3b387a, not stripped

# ls /dev/tpm*
/dev/tpm0 /dev/tpmrm0

# tpm2_getcap -T device:/dev/tpmrm0 ecc-curves
TPM2_ECC_NIST_P256: 0x3
TPM2_ECC_NIST_P384: 0x4
TPM2_ECC_BN_P256: 0x10
TPM2_ECC_SM2_P256: 0x20
```

## Expected Behavior
The prebuilt GNU/Linux binary should include native Linux TPM 2.0 support.

## Actual Behavior
See above.

## Environment
- OS: Linux (Fedora 43)
- Hardware: Lenovo ThinkBook 16 G6 IRL
- sshenc version: 0.6.101 (gnu)

Contributor guide

Open the contributing guide

Research direction

Start in Cargo.toml at the hardware-enclave dependency and compare its enabled features with the upstream linux-tpm option described in the issue. Build or inspect the GNU/Linux release configuration, then run sshenc agent on a Linux system with /dev/tpm0 or /dev/tpmrm0; done means the prebuilt binary initializes the native TPM backend instead of reporting that the hardware security module is unavailable.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Active
Clarity
Clearly specified
Newbie friendliness
76/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.