Nginx restart

[simonetolotti]

I'm using Nginx with TPM and when I restart Nginx because I modify the configuration, I have the following error and the SSL connection doesn't work:

* nginx.service - The NGINX HTTP and reverse proxy server
     Loaded: loaded (/lib/systemd/system/nginx.service; enabled; vendor preset: enabled)
     Active: active (running) since Mon 2021-05-17 14:36:16 CEST; 4s ago
    Process: 7159 ExecStartPre=/usr/sbin/nginx -t (code=exited, status=0/SUCCESS)
    Process: 7166 ExecStart=/usr/sbin/nginx (code=exited, status=0/SUCCESS)
   Main PID: 7171 (nginx)
      Tasks: 2 (limit: 445)
     Memory: 1.3M
     CGroup: /system.slice/nginx.service
             |-7171 nginx: master process /usr/sbin/nginx
             `-7172 nginx: worker process

May 17 14:36:15 m172-si nginx[7166]: ERROR:tcti:../tpm2-tss-2.3.2/src/tss2-tcti/tctildr-dl.c:150:tcti_from_file() Could not initialize TCTI file: libtss2-tcti-default.>
May 17 14:36:15 m172-si nginx[7166]: ERROR:tcti:../tpm2-tss-2.3.2/src/tss2-tcti/tcti-device.c:439:Tss2_Tcti_Device_Init() Failed to open device file /dev/tpm0: Device >
May 17 14:36:15 m172-si nginx[7166]: WARNING:tcti:../tpm2-tss-2.3.2/src/tss2-tcti/tctildr.c:62:tcti_from_init() TCTI init for function 0x7655367d failed with a000a
May 17 14:36:15 m172-si nginx[7166]: WARNING:tcti:../tpm2-tss-2.3.2/src/tss2-tcti/tctildr.c:92:tcti_from_info() Could not initialize TCTI named: tcti-device
May 17 14:36:15 m172-si nginx[7166]: ERROR:tcti:../tpm2-tss-2.3.2/src/tss2-tcti/tctildr-dl.c:150:tcti_from_file() Could not initialize TCTI file: libtss2-tcti-default.>
May 17 14:36:15 m172-si nginx[7166]: ERROR:tcti:../tpm2-tss-2.3.2/src/tss2-tcti/tcti-device.c:439:Tss2_Tcti_Device_Init() Failed to open device file /dev/tpm0: Device >
May 17 14:36:15 m172-si nginx[7166]: WARNING:tcti:../tpm2-tss-2.3.2/src/tss2-tcti/tctildr.c:62:tcti_from_init() TCTI init for function 0x7655367d failed with a000a
May 17 14:36:15 m172-si nginx[7166]: WARNING:tcti:../tpm2-tss-2.3.2/src/tss2-tcti/tctildr.c:92:tcti_from_info() Could not initialize TCTI named: tcti-device
May 17 14:36:15 m172-si nginx[7166]: ERROR:tcti:../tpm2-tss-2.3.2/src/tss2-tcti/tctildr-dl.c:150:tcti_from_file() Could not initialize TCTI file: libtss2-tcti-default.>
May 17 14:36:16 m172-si systemd[1]: Started The NGINX HTTP and reverse proxy server.

the only way to change NGINX config without error is to stop tpm2-abrmd before restart NGINX.

systemctl stop tpm2-abrmd.service
systemctl restart nginx.service

Moreover, if I use getrandom before the connection to WebApp I don't have any issue. Nevertheless after the first connection, I have the following error (also if I close the browser)

tpm2_getrandom 48 | xxd -p
ERROR:tcti:../tpm2-tss-2.3.2/src/tss2-tcti/tcti-device.c:439:Tss2_Tcti_Device_Init() Failed to open device file /dev/tpm0: Device or resource busy
WARNING:tcti:../tpm2-tss-2.3.2/src/tss2-tcti/tctildr.c:62:tcti_from_init() TCTI init for function 0x76b0067d failed with a000a
WARNING:tcti:../tpm2-tss-2.3.2/src/tss2-tcti/tctildr.c:92:tcti_from_info() Could not initialize TCTI named: tcti-device
ERROR:tcti:../tpm2-tss-2.3.2/src/tss2-tcti/tctildr-dl.c:150:tcti_from_file() Could not initialize TCTI file: libtss2-tcti-default.so
ac8b2dabdbe2f540d93651e55459b4b9ec6a3d21b73ce0acf1c33ba28dfd
e53479775fe77c975ab6ce5a0fd8b232ff0c

it seems which Nginx doesn't release the TPM.