tpm-enrol: allow enrolment under rd.dot1x=0 (test-mode) for bench testing

Removes the hard no-op on the test path so the enrolment flow can be exercised
on a host with a TPM + a reachable broker WITHOUT standing up 802.1X/MACsec/
RADIUS. Networking is now mode-aware: in test mode ip=dhcp already owns the NIC
(and wrote resolv.conf), so the hook uses the existing lease instead of running
its own nmcli DHCP — avoiding the dracut "address already assigned" race
(CLAUDE.md "don't double-configure the NIC in test mode"). Secure mode still does
the nm-unmanaged override for the pre-auth lease. rd.fleet.enrol=0 disables
enrolment in either mode; production intent stays secure-path-only.

docs/TODO.md

@@ -1024,6 +1024,14 @@ golang` + the 2d removal). `fleet-enrol` lands at `/usr/sbin` before the initram
 build (dracut `inst_simple`s it; asserted in `lsinitrd`), fapolicyd-trusted.
 New `enrol_url` Packer var → `rd.fleet.enrol_url` cmdline.
 
+**TEST-MODE ENROLMENT ENABLED (2026-07-02, temporary):** the hook no longer
+no-ops under `rd.dot1x=0` — enrolment runs on the open/test path too, so it can be
+exercised on a host with a TPM + the broker WITHOUT standing up
+802.1X/MACsec/RADIUS. In test mode `ip=dhcp` owns the NIC (the hook skips its own
+DHCP to avoid the dracut "address already assigned" race) and DNS resolves the
+broker via the lease. `rd.fleet.enrol=0` disables it. Production intent is still
+secure-path-only; revisit when the secure path is bench-verified.
+
 **TESTED (2026-07-02):** transaction logic (CSR → mock broker → approve → cert
 extract) as stdlib unit tests, AND the **full TPM ceremony (key-gen → persist →
 ECDSA sign → CSR verify → chunked NV write → re-enrol) against the go-tpm software

files/dracut/95dot1x-macsec/tpm-enrol.sh

@@ -5,15 +5,21 @@
 # build whose TPM NV 0x01800001 is empty, it brings up a pre-auth network on the
 # physical NIC and hands off to the out-of-VM `fleet-enrol` binary (Go + go-tpm),
 # which generates the key/CSR, talks to the broker, shows the Plymouth
-# fingerprint, and writes the issued cert to NV. On success this hook REBOOTS
-# into the normal secure path. It is a no-op when a cert is already present
-# (normal boot — dot1x-macsec-up.sh reads NV) or under rd.dot1x=0 (test path).
+# fingerprint, and writes the issued cert to NV. On success this hook REBOOTS.
+# It is a no-op when a cert is already present (normal boot — dot1x-macsec-up.sh
+# reads NV) or when disabled via rd.fleet.enrol=0.
 #
 # The crypto/HTTP/NV work lives in the binary (testable, TPM-direct); this hook
-# owns only the boot-environment concerns: the empty-NV gate, the pre-auth DHCP
-# (which the secure-mode nm-unmanaged.sh otherwise withholds from en*), and the
-# reboot-to-converge. Empty-NV and the secure path are mutually exclusive, so
-# this never reorders the load-bearing boot sequence (invariant #2).
+# owns only the boot-environment concerns: the empty-NV gate, networking, and the
+# reboot-to-converge. Empty-NV and the secure path are mutually exclusive, so this
+# never reorders the load-bearing boot sequence (invariant #2).
+#
+# TEST-MODE ENROLMENT (rd.dot1x=0): enrolment ALSO runs on the open/test path so
+# the flow can be exercised on a host with a TPM + a reachable broker WITHOUT
+# standing up 802.1X/MACsec/RADIUS. In test mode `ip=dhcp` already owns the NIC,
+# so this hook must NOT re-DHCP it (that races dracut → "address already
+# assigned"); it just uses the existing lease. Production still gates real
+# enrolment to the secure path; use rd.fleet.enrol=0 to disable it in either mode.
 
 type getarg >/dev/null 2>&1 || . /lib/dracut-lib.sh
 
@@ -23,10 +29,13 @@ mkdir -p /run/dot1x
 export TPM2TOOLS_TCTI="device:/dev/tpmrm0"
 
 # --- skip conditions --------------------------------------------------------
-[ "$(getarg rd.dot1x=)" = "0" ] && exit 0                 # test path: no identity to enrol
 if [ "$(getarg rd.fleet.enrol=)" = "0" ]; then
     info "tpm-enrol: disabled by rd.fleet.enrol=0"; exit 0
 fi
+# Test mode (rd.dot1x=0): enrolment still runs, but ip=dhcp owns the NIC, so we
+# must not reconfigure it below.
+TESTMODE=0
+[ "$(getarg rd.dot1x=)" = "0" ] && TESTMODE=1
 
 # --- knobs (override on the kernel cmdline) ---------------------------------
 NVINDEX=$(getarg rd.dot1x.nvindex=); [ -n "$NVINDEX" ] || NVINDEX=0x01800001
@@ -64,14 +73,21 @@ if [ -z "$NIC" ]; then
 fi
 [ -n "$NIC" ] || { warn "tpm-enrol: no network interface found"; exit 1; }
 
-# --- pre-auth network on the PHYSICAL NIC -----------------------------------
-# Secure-mode nm-unmanaged.sh leaves en* UNMANAGED (wpa_supplicant would own it),
-# but there is no supplicant yet — so explicitly hand the NIC to NM for a
-# plaintext pre-auth DHCP lease (same permit-set the firmware used for the UKI).
-# The runtime `nmcli device set managed yes` overrides the unmanaged drop-in.
-ip link set "$NIC" up 2>/dev/null || true
-nmcli device set "$NIC" managed yes 2>/dev/null || true
-nmcli -w 0 device connect "$NIC" 2>/dev/null || true
+# --- network on the PHYSICAL NIC --------------------------------------------
+if [ "$TESTMODE" = "1" ]; then
+    # Test mode: ip=dhcp already brought the NIC up + wrote resolv.conf. Do NOT
+    # reconfigure it (a second config races dracut → "address already assigned").
+    info "tpm-enrol: test mode (rd.dot1x=0) — using the ip=dhcp NIC as-is"
+    ip link set "$NIC" up 2>/dev/null || true
+else
+    # Secure mode: nm-unmanaged.sh leaves en* UNMANAGED (wpa_supplicant would own
+    # it), but there is no supplicant yet — so explicitly hand the NIC to NM for a
+    # plaintext pre-auth DHCP lease (same permit-set the firmware used for the UKI).
+    # The runtime `nmcli device set managed yes` overrides the unmanaged drop-in.
+    ip link set "$NIC" up 2>/dev/null || true
+    nmcli device set "$NIC" managed yes 2>/dev/null || true
+    nmcli -w 0 device connect "$NIC" 2>/dev/null || true
+fi
 i=0
 while [ "$i" -lt "$NETTMO" ]; do
     ip -4 addr show "$NIC" 2>/dev/null | grep -q 'inet ' && break