{"record":{"id":"793b3e9f66aaca03","repo":"gravitational/teleport","slug":"elevated-credential-activation-not-implemented-for","errorCode":null,"errorMessage":"elevated credential activation not implemented for linux","messagePattern":"elevated credential activation not implemented for linux","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"lib/devicetrust/native/device_linux.go","lineNumber":54,"sourceCode":"\t\"google.golang.org/protobuf/types/known/timestamppb\"\n\n\t\"github.com/gravitational/teleport\"\n\tdevicepb \"github.com/gravitational/teleport/api/gen/proto/go/teleport/devicetrust/v1\"\n\t\"github.com/gravitational/teleport/lib/linux\"\n\thostuser \"github.com/gravitational/teleport/session/host/user\"\n)\n\n// deviceStateFolderName starts without a \".\" on Linux systems.\nconst deviceStateFolderName = \"teleport-device\"\n\nvar linuxDevice = &tpmDevice{\n\tisElevatedProcess: func() (bool, error) {\n\t\t// Always run TPM operations in-process.\n\t\t// The Linux impl will selectively escalate, via sudo, if necessary.\n\t\treturn true, nil\n\t},\n\tactivateCredentialInElevatedChild: func(encryptedCredential attest.EncryptedCredential, credActivationPath string, debug bool) ([]byte, error) {\n\t\treturn nil, errors.New(\"elevated credential activation not implemented for linux\")\n\t},\n}\n\nfunc enrollDeviceInit() (*devicepb.EnrollDeviceInit, error) {\n\tinit, err := linuxDevice.enrollDeviceInit()\n\treturn init, rewriteTPMPermissionError(err)\n}\n\nfunc signChallenge(chal []byte) (sig []byte, err error) {\n\treturn nil, errors.New(\"signChallenge not implemented for TPM devices\")\n}\n\nfunc getDeviceCredential() (*devicepb.DeviceCredential, error) {\n\tcred, err := linuxDevice.getDeviceCredential()\n\treturn cred, rewriteTPMPermissionError(err)\n}\n\nfunc solveTPMEnrollChallenge(","sourceCodeStart":36,"sourceCodeEnd":72,"githubUrl":"https://github.com/gravitational/teleport/blob/1283425b60ec5f60d509ba4c791183d452923ff7/lib/devicetrust/native/device_linux.go#L36-L72","documentation":"This ad-hoc error is returned by the Linux device trust native implementation's activateCredentialInElevatedChild hook (lib/devicetrust/native/device_linux.go:54). Linux performs TPM credential activation in-process, so the elevated-child activation path (used on other platforms where TPM operations require a privileged child process) is intentionally unimplemented and always fails with this error.","triggerScenarios":"Calling device trust key activation (activateCredential) on Linux in a code path that routes through activateCredentialInElevatedChild — i.e., requesting elevated TPM credential activation instead of the in-process path.","commonSituations":"Device trust enrollment/authentication on a Linux host where the TPM requires privilege escalation for credential activation; running without the necessary TPM access permissions so the code attempts the (unimplemented) elevated path.","solutions":["Ensure the process has direct TPM access (run with sufficient privileges or correct /dev/tpm* ownership/group membership, e.g. tss group) so the in-process path is used.","Verify the tpm2 tooling/daemon configuration; rewriteTPMPermissionError-related permission issues often push code toward escalation.","If elevated activation is genuinely required, it must be implemented for Linux — file/track an upstream feature request.","Use the standard Linux device trust enrollment flow which performs activation in-process (isElevatedProcess always returns true)."],"exampleFix":"// before (Linux, insufficient TPM perms -> attempts unimplemented elevated path)\ncert, err := activateCredential(cred)\n// after\n// grant TPM access so in-process activation is used:\n// $ sudo usermod -aG tss $USER  (and re-login)\ncert, err := activateCredential(cred) // in-process, no elevated child needed","handlingStrategy":"validation","validationCode":"if runtime.GOOS == \"linux\" {\n    // ensure direct TPM access so the in-process (not elevated-child) path is used\n    if _, err := os.Stat(\"/dev/tpmrm0\"); err != nil {\n        return fmt.Errorf(\"TPM unavailable: %w\", err)\n    }\n}","typeGuard":"func IsNotImplementedElevated(err error) bool {\n    return err != nil && strings.Contains(err.Error(), \"elevated credential activation not implemented\")\n}","tryCatchPattern":"cert, err := activateCredential(cred)\nif err != nil && strings.Contains(err.Error(), \"not implemented for linux\") {\n    return trace.Wrap(err, \"elevated TPM activation unsupported on linux; fix TPM permissions for in-process activation\")\n}","preventionTips":["Ensure the process has direct TPM access (tss group, correct /dev/tpm* permissions) so in-process activation is used","Do not build Linux flows that depend on elevated-child TPM activation","Track upstream support for elevated credential activation on Linux before using that path"],"tags":["devicetrust","tpm","linux","unimplemented"],"backgroundTag":"not-implemented-for-platform","analyzedSha":"1283425b60ec5f60d509ba4c791183d452923ff7","analyzedAt":"2026-09-02T04:06:41.601Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}