Describe the bug

Plugins built with systemd are not available in cryptsetup

machine # [    5.839874] systemd-cryptsetup[455]: Token 0 unusable for segment 0 with desired keyslot priority 2.
machine # [    5.840623] systemd-cryptsetup[455]: Trying to load /nix/store/l6y9kks5z6ywsxivnld12hh326lbx2yc-cryptsetup-2.4.3/lib/cryptsetup/libcryptsetup-token-systemd-tpm2.so.
machine # [    5.841665] systemd-cryptsetup[455]: /nix/store/l6y9kks5z6ywsxivnld12hh326lbx2yc-cryptsetup-2.4.3/lib/cryptsetup/libcryptsetup-token-systemd-tpm2.so: cannot open shared object file: No such file or directory
machine # [    5.842962] systemd-cryptsetup[455]: No TPM2 metadata enrolled in LUKS2 header or TPM2 support not available, falling back to traditional unlocking.

Steps To Reproduce

Steps to reproduce the behavior:

Local with TPM2

systemd-cryptenroll --tpm2-device=list
dd if=/dev/zero of=encrypted.img bs=1 count=0 seek=1G
echo -n lukspass | cryptsetup luksFormat -q encrypted.img -

# confirm it works with cryptsetup and password
sudo cryptsetup luksOpen encrypted.img foo
# enter password: lukspass
sudo cryptsetup luksClose foo

# enroll tpm2
sudo PASSWORD=lukspass systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=7 encrypted.img
sudo ${pkgs.systemd}/lib/systemd/systemd-cryptsetup attach luks encrypted.img - tpm2-device=auto

Password prompt appears:

Set cipher aes, mode xts-plain64, key size 512 bits for device encrypted.img.
🔐 Please enter passphrase for disk foo: (press TAB for no echo)

#cleanup
sudo systemd-cryptenroll --wipe-slot=tpm2 encrypted.img

Using tests with swtpm

1. enable debug in systemd boot.kernelParams = [ "systemd.log_level=debug" "systemd.log_target=console" "console=ttyS0,38400" "console=tty1" ];
2. run the test nix build .#nixosTests.systemd-cryptenroll (give it a minute since it spits out lots of debug statement)
3. inspect the log nix log .#nixosTests.systemd-cryptenroll

Expected behavior

Password prompt should not appear

Additional context

#139864 should've been caught this issue

strace suggests that the new systemd feature is to blame:

1933590 openat(AT_FDCWD, "/nix/store/l6y9kks5z6ywsxivnld12hh326lbx2yc-cryptsetup-2.4.3/lib/cryptsetup/libcryptsetup-token-systemd-tpm2.so", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)

It seems like cryptsetup expects the library to be present under ${cryptsetup}/lib/cryptsetup but it's present under ${systemd}/lib/cryptsetup
No matter what I do I get into dependency loop 🤷🏻

Notify maintainers

@flokli @kloenk @Mic92

Metadata

Please run nix-shell -p nix-info --run "nix-info -m" and paste the result.

 - system: `"x86_64-linux"`
 - host os: `Linux 5.17.1, NixOS, 22.05 (Quokka)`
 - multi-user?: `yes`
 - sandbox: `yes`
 - version: `nix-env (Nix) 2.8.0pre20220322_d5d4d98`
 - channels(ymatsiuk): `""`
 - channels(root): `"nixos"`
 - nixpkgs: `/nix/var/nix/profiles/per-user/root/channels/nixos`