gravitational/teleport · error

elevated credential activation not implemented for linux

Error message

elevated credential activation not implemented for linux

What it means

This ad-hoc error is returned by the Linux device trust native implementation's activateCredentialInElevatedChild hook (lib/devicetrust/native/device_linux.go:54). Linux performs TPM credential activation in-process, so the elevated-child activation path (used on other platforms where TPM operations require a privileged child process) is intentionally unimplemented and always fails with this error.

Source

Thrown at lib/devicetrust/native/device_linux.go:54

	"google.golang.org/protobuf/types/known/timestamppb"

	"github.com/gravitational/teleport"
	devicepb "github.com/gravitational/teleport/api/gen/proto/go/teleport/devicetrust/v1"
	"github.com/gravitational/teleport/lib/linux"
	hostuser "github.com/gravitational/teleport/session/host/user"
)

// deviceStateFolderName starts without a "." on Linux systems.
const deviceStateFolderName = "teleport-device"

var linuxDevice = &tpmDevice{
	isElevatedProcess: func() (bool, error) {
		// Always run TPM operations in-process.
		// The Linux impl will selectively escalate, via sudo, if necessary.
		return true, nil
	},
	activateCredentialInElevatedChild: func(encryptedCredential attest.EncryptedCredential, credActivationPath string, debug bool) ([]byte, error) {
		return nil, errors.New("elevated credential activation not implemented for linux")
	},
}

func enrollDeviceInit() (*devicepb.EnrollDeviceInit, error) {
	init, err := linuxDevice.enrollDeviceInit()
	return init, rewriteTPMPermissionError(err)
}

func signChallenge(chal []byte) (sig []byte, err error) {
	return nil, errors.New("signChallenge not implemented for TPM devices")
}

func getDeviceCredential() (*devicepb.DeviceCredential, error) {
	cred, err := linuxDevice.getDeviceCredential()
	return cred, rewriteTPMPermissionError(err)
}

func solveTPMEnrollChallenge(

View on GitHub (pinned to 1283425b60)

Solutions

1. Ensure the process has direct TPM access (run with sufficient privileges or correct /dev/tpm* ownership/group membership, e.g. tss group) so the in-process path is used.
2. Verify the tpm2 tooling/daemon configuration; rewriteTPMPermissionError-related permission issues often push code toward escalation.
3. If elevated activation is genuinely required, it must be implemented for Linux — file/track an upstream feature request.
4. Use the standard Linux device trust enrollment flow which performs activation in-process (isElevatedProcess always returns true).

Example fix

// before (Linux, insufficient TPM perms -> attempts unimplemented elevated path)
cert, err := activateCredential(cred)
// after
// grant TPM access so in-process activation is used:
// $ sudo usermod -aG tss $USER  (and re-login)
cert, err := activateCredential(cred) // in-process, no elevated child needed

if runtime.GOOS == "linux" {
    // ensure direct TPM access so the in-process (not elevated-child) path is used
    if _, err := os.Stat("/dev/tpmrm0"); err != nil {
        return fmt.Errorf("TPM unavailable: %w", err)
    }
}

func IsNotImplementedElevated(err error) bool {
    return err != nil && strings.Contains(err.Error(), "elevated credential activation not implemented")
}

cert, err := activateCredential(cred)
if err != nil && strings.Contains(err.Error(), "not implemented for linux") {
    return trace.Wrap(err, "elevated TPM activation unsupported on linux; fix TPM permissions for in-process activation")
}

When it happens

Trigger: Calling device trust key activation (activateCredential) on Linux in a code path that routes through activateCredentialInElevatedChild — i.e., requesting elevated TPM credential activation instead of the in-process path.

Common situations: Device trust enrollment/authentication on a Linux host where the TPM requires privilege escalation for credential activation; running without the necessary TPM access permissions so the code attempts the (unimplemented) elevated path.

Related errors

• User logged in error
• user not managed by teleport

AI-assisted analysis of gravitational/teleport@1283425b60 (2026-09-02). Data as JSON: /api/errors/793b3e9f66aaca03. Report an issue: GitHub.