{"record":{"id":"342e36d8b2c4163b","repo":"gravitational/teleport","slug":"failed-to-open-the-tpm-device-consider-assigning","errorCode":null,"errorMessage":"failed to open the TPM device, consider assigning the user to the `tss` group or creating equivalent udev rules","messagePattern":"failed to open the TPM device, consider assigning the user to the `tss` group or creating equivalent udev rules","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"lib/devicetrust/native/device_linux.go","lineNumber":112,"sourceCode":"\t//\n\t// \terr = &fs.PathError{\n\t// \t\tPath: \"/dev/tpmrm0\",\n\t// \t\tErr: fs.ErrPermission,\n\t// \t}\n\tif !errors.Is(err, fs.ErrPermission) {\n\t\treturn err\n\t}\n\n\tpathErr := &fs.PathError{}\n\tif !errors.As(err, &pathErr) || pathErr.Path != \"/dev/tpmrm0\" {\n\t\treturn err\n\t}\n\tslog.DebugContext(context.Background(), \"Replacing TPM permission error with a more friendly one\",\n\t\tteleport.ComponentKey, \"TPM\",\n\t\t\"error\", err,\n\t)\n\n\treturn errors.New(\"\" +\n\t\t\"failed to open the TPM device, \" +\n\t\t\"consider assigning the user to the `tss` group or creating equivalent udev rules\")\n}\n\n// cddFuncs is used to mock various data collection functions for testing.\nvar cddFuncs = struct {\n\tparseOSRelease       func() (*linux.OSRelease, error)\n\tdmiInfoFromSysfs     func() (*linux.DMIInfo, error)\n\treadDMIInfoCached    func() (*linux.DMIInfo, error)\n\treadDMIInfoEscalated func() (*linux.DMIInfo, error)\n\tsaveDMIInfoToCache   func(*linux.DMIInfo) error\n}{\n\tparseOSRelease:       linux.ParseOSRelease,\n\tdmiInfoFromSysfs:     linux.DMIInfoFromSysfs,\n\treadDMIInfoCached:    readDMIInfoCached,\n\treadDMIInfoEscalated: readDMIInfoEscalated,\n\tsaveDMIInfoToCache:   saveDMIInfoToCache,\n}","sourceCodeStart":94,"sourceCodeEnd":130,"githubUrl":"https://github.com/gravitational/teleport/blob/1283425b60ec5f60d509ba4c791183d452923ff7/lib/devicetrust/native/device_linux.go#L94-L130","documentation":"rewriteTPMPermissionError rewrites a raw fs.ErrPermission PathError on /dev/tpmrm0 into this friendly error: the Linux process cannot access the TPM 2.0 resource-manager device, typically because it lacks the tss group membership or udev rules.","triggerScenarios":"Thrown at lib/devicetrust/native/device_linux.go:112 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Add the user to the tss group: sudo usermod -aG tss $USER, then re-login","Ensure udev rules granting tss group access to /dev/tpmrm0 are installed and reloaded","Verify the device exists and has correct ownership: ls -l /dev/tpmrm0"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"1283425b60ec5f60d509ba4c791183d452923ff7","analyzedAt":"2026-09-02T04:06:41.601Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}