gravitational/teleport · error

failed to open the TPM device, consider assigning the user t

Error message

failed to open the TPM device, consider assigning the user to the `tss` group or creating equivalent udev rules

What it means

rewriteTPMPermissionError rewrites a raw fs.ErrPermission PathError on /dev/tpmrm0 into this friendly error: the Linux process cannot access the TPM 2.0 resource-manager device, typically because it lacks the tss group membership or udev rules.

Source

Thrown at lib/devicetrust/native/device_linux.go:112

	//
	// 	err = &fs.PathError{
	// 		Path: "/dev/tpmrm0",
	// 		Err: fs.ErrPermission,
	// 	}
	if !errors.Is(err, fs.ErrPermission) {
		return err
	}

	pathErr := &fs.PathError{}
	if !errors.As(err, &pathErr) || pathErr.Path != "/dev/tpmrm0" {
		return err
	}
	slog.DebugContext(context.Background(), "Replacing TPM permission error with a more friendly one",
		teleport.ComponentKey, "TPM",
		"error", err,
	)

	return errors.New("" +
		"failed to open the TPM device, " +
		"consider assigning the user to the `tss` group or creating equivalent udev rules")
}

// cddFuncs is used to mock various data collection functions for testing.
var cddFuncs = struct {
	parseOSRelease       func() (*linux.OSRelease, error)
	dmiInfoFromSysfs     func() (*linux.DMIInfo, error)
	readDMIInfoCached    func() (*linux.DMIInfo, error)
	readDMIInfoEscalated func() (*linux.DMIInfo, error)
	saveDMIInfoToCache   func(*linux.DMIInfo) error
}{
	parseOSRelease:       linux.ParseOSRelease,
	dmiInfoFromSysfs:     linux.DMIInfoFromSysfs,
	readDMIInfoCached:    readDMIInfoCached,
	readDMIInfoEscalated: readDMIInfoEscalated,
	saveDMIInfoToCache:   saveDMIInfoToCache,
}

View on GitHub (pinned to 1283425b60)

Solutions

1. Add the user to the tss group: sudo usermod -aG tss $USER, then re-login
2. Ensure udev rules granting tss group access to /dev/tpmrm0 are installed and reloaded
3. Verify the device exists and has correct ownership: ls -l /dev/tpmrm0

When it happens

Trigger: Thrown at lib/devicetrust/native/device_linux.go:112 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of gravitational/teleport@1283425b60 (2026-09-02). Data as JSON: /api/errors/342e36d8b2c4163b. Report an issue: GitHub.