fix: ResealForCurrentKernel D-Bus method is a stub #27

New issue

Closed

opened 2026-07-29 10:59:26 +02:00 by elegos · 0 comments

elegos commented

2026-07-29 10:59:26 +02:00

Owner

Issue

crates/linux-hello-daemon/src/dbus.rs:308–313: the ResealForCurrentKernel D-Bus method returns NotSupported("reseal_for_current_kernel not yet implemented (EPIC-18)").

Impact

On T3 systems (PCR 7 + PCR 11 / UKI boot), after a failed kernel pre-seal the user can log in via password, but cannot reseal from the running kernel without a CLI workaround (linux-hello-tpm reseal --kernel $(uname -r)). The settings UI path (ARCHITECTURE.md §13 Recovery path B) is broken.

Fix

Implement reseal_for_current_kernel in the daemon: call linux-hello-tpm::TpmBackend::reseal_user_key for each user's sealed key against the current kernel's measured PCR 11 value. Polkit-protected.

## Issue `crates/linux-hello-daemon/src/dbus.rs:308–313`: the `ResealForCurrentKernel` D-Bus method returns `NotSupported("reseal_for_current_kernel not yet implemented (EPIC-18)")`. ## Impact On T3 systems (PCR 7 + PCR 11 / UKI boot), after a failed kernel pre-seal the user can log in via password, but cannot reseal from the running kernel without a CLI workaround (`linux-hello-tpm reseal --kernel $(uname -r)`). The settings UI path (ARCHITECTURE.md §13 Recovery path B) is broken. ## Fix Implement `reseal_for_current_kernel` in the daemon: call `linux-hello-tpm::TpmBackend::reseal_user_key` for each user's sealed key against the current kernel's measured PCR 11 value. Polkit-protected.

elegos added this to the Foundation project

2026-07-29 10:59:36 +02:00

elegos removed this from the Foundation project

2026-07-29 10:59:42 +02:00

elegos added this to the Foundation project

2026-07-29 11:00:01 +02:00

elegos

2026-07-29 11:20:27 +02:00