[SOLVED] genkernel, cryptsetup and tpm2

[mbar]

Hi all, I'm trying to do the following:
https://wiki.archlinux.org/title/Trusted_Platform_Module#Data-at-rest_encryption_with_LUKS

I'd like to use TPM 2.0 chip in my laptop (Precision 5510) to store unlock key for root partition.
Right now I have working setup with passphrase that I have to enter during boot. I'm using genkernel, systemd just as described in some article in Gentoo's wiki.

I can enroll crypto key on TPM2 chip:

[salahx]

I don't think it'll work with genkernel initramfs, but dracut should work.

To make it work with dracut, you'll need the current dracut - currently unstable, so you'll need to add it to packages.accept_keywords.

Create a new initramfs with the tpm2-tss module (dracut -a tpm2-tss) or add it to dracut config file.

Add rd.luks.options={UUID}=tpm2-device=auto (substitue the UUID for {UUID}) to the kernel command line.

When you next reboot, it should unlock the drive autoamtically

[mbar]

Thanks, it is almost working now.
I have some kind of dependency error:

https://imgur.com/MOEtOS5

After a while it timeouts. Should I enable something in systemd?

EDIT: I also found this, but I think my problem may be simple configuration error. This is the first time I use dracut. https://github.com/dracutdevs/dracut/issues/723

Also foud this https://forums.gentoo.org/viewtopic-t-1144197.html

[mbar]

Well, it seems that dracut does not have TPM2 support, any chance to add this as a module?

[mbar]

Solved, installing dracut and app-crypt/tpm2-tools helped.