From fdb92fde7db419185f885c6291d9a5562e94fe08 Mon Sep 17 00:00:00 2001 From: Michal Fox Date: Sat, 3 Oct 2026 01:49:04 +0200 Subject: [PATCH] fix #5858: tpmstate: allow excluding the TPM state from backups Disks can be excluded from backups with the 'backup' flag, but the TPM state does not support it. Guests can keep secrets in the TPM, like the key to automatically unlock disk encryption, so a backup that includes the TPM state can be enough to get at the data. Users might want to keep the TPM state out of the backup and rely on a recovery key after restoring instead. Add the 'backup' flag to the TPM state, like for other disks. Backups already honor it for all volumes of the configuration, so a TPM state with 'backup=0' is skipped and logged as excluded in the backup task log, and on restore, its line is commented out like for other excluded disks. Signed-off-by: Michal Fox --- src/PVE/QemuServer/Drive.pm | 1 + .../parse-config-input/tpmstate-no-backup.conf | 16 ++++++++++++++++ src/test/run_parse_config_tests.pl | 2 +- 3 files changed, 18 insertions(+), 1 deletion(-) create mode 100644 src/test/parse-config-input/tpmstate-no-backup.conf diff --git a/src/PVE/QemuServer/Drive.pm b/src/PVE/QemuServer/Drive.pm index 0b57371..72abac0 100644 --- a/src/PVE/QemuServer/Drive.pm +++ b/src/PVE/QemuServer/Drive.pm @@ -594,6 +594,7 @@ my $tpmstate_fmt = { description => "Disk size. This is purely informational and has no effect.", optional => 1, }, + backup => $drivedesc_base{backup}, %tpmversion_fmt, }; my $tpmstate_desc = { diff --git a/src/test/parse-config-input/tpmstate-no-backup.conf b/src/test/parse-config-input/tpmstate-no-backup.conf new file mode 100644 index 0000000..1560372 --- /dev/null +++ b/src/test/parse-config-input/tpmstate-no-backup.conf @@ -0,0 +1,16 @@ +# VM with a TPM state that is excluded from backups +bios: ovmf +boot: order=scsi0;net0 +cores: 2 +efidisk0: local-lvm:vm-8006-disk-0,efitype=4m,ms-cert=2023k,pre-enrolled-keys=1,size=4M +machine: pc-q35-10.1 +memory: 4096 +name: win11 +net0: virtio=BC:24:11:3E:8A:D1,bridge=vmbr0 +ostype: win11 +scsi0: local-lvm:vm-8006-disk-1,size=64G +scsihw: virtio-scsi-single +smbios1: uuid=5b1f3c7e-2d4a-4c8e-9f6b-7a3e1d2c4b5f +sockets: 1 +tpmstate0: local-lvm:vm-8006-disk-2,backup=0,size=4M,version=v2.0 +vmgenid: 6a7d2f3e-1b4c-4d5e-8f9a-0b1c2d3e4f5a diff --git a/src/test/run_parse_config_tests.pl b/src/test/run_parse_config_tests.pl index 62e36ee..84602e4 100644 --- a/src/test/run_parse_config_tests.pl +++ b/src/test/run_parse_config_tests.pl @@ -26,7 +26,7 @@ my $OUTPUT_DIR = './parse-config-output'; my $EXPECTED_DIR = './parse-config-expected'; # NOTE update when you add/remove tests -plan tests => 2 * 10; +plan tests => 2 * 11; sub run_tests { my ($strict) = @_;