SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

man: document ukify SignInitrdPCRs setting

Browse Source 
UKI/SignInitrdPCRs was added together with --sign-initrd-pcrs, but only
that command-line option is documented. Document the configuration key
and move the entry to the [UKI] section.

Fixes #43863.

(cherry picked from commit 4f8ca5032fd0633c6b5caff4868a375ac91b5b0f)
This commit is contained in:
Jonghyun An
2026-10-16 11:36:33 +01:00
committed by Luca Boccassi
parent 121d621934
commit 1de356e556
1 changed files with 20 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
man/ukify.xml
+20 -19
View File
@@ -236,25 +236,6 @@
<xi:include href="version-info.xml" xpointer="v258"/></listitem>
</varlistentry>
<varlistentry>
<term><option>--sign-initrd-pcrs</option></term>
<term><option>--no-sign-initrd-pcrs</option></term>
<listitem><para>Enable or disable signing of additional PCR policies that are bound to the initrd
phase (after <literal>enter-initrd</literal> and before <literal>leave-initrd</literal>) and the
<literal>initrd</literal> policy reference. These additional signed policies are consumed by
<citerefentry><refentrytitle>systemd-tpm2-setup-early.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>
to authorize the initialization of NvPCRs. They are also useful for enrolling TPM keyslots to encrypted
volumes that can only be unlocked from the initrd with
<citerefentry><refentrytitle>systemd-cryptenroll</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
by using the <option>--tpm2-public-key-policyref=initrd</option> option. The extra signatures reuse
the first <varname>PCRPrivateKey=</varname>/<option>--pcr-private-key=</option>, hence one must be
specified, unless <option>--policy-digest</option> is used to generate the policies for offline
signing. Defaults to false.</para>
<xi:include href="version-info.xml" xpointer="v262"/></listitem>
</varlistentry>
<varlistentry>
<term><option>--section=<replaceable>NAME</replaceable>:<replaceable>TEXT</replaceable>|<replaceable>@PATH</replaceable></option></term>
<term><option>--section=<replaceable>NAME</replaceable>:text|binary<optional>@<replaceable>PATH</replaceable></optional></option></term>
@@ -557,6 +538,26 @@
<xi:include href="version-info.xml" xpointer="v253"/></listitem>
</varlistentry>
<varlistentry>
<term><varname>SignInitrdPCRs=<replaceable>BOOL</replaceable></varname></term>
<term><option>--sign-initrd-pcrs</option></term>
<term><option>--no-sign-initrd-pcrs</option></term>
<listitem><para>Enable or disable signing of additional PCR policies that are bound to the initrd
phase (after <literal>enter-initrd</literal> and before <literal>leave-initrd</literal>) and the
<literal>initrd</literal> policy reference. These additional signed policies are consumed by
<citerefentry><refentrytitle>systemd-tpm2-setup-early.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>
to authorize the initialization of NvPCRs. They are also useful for enrolling TPM keyslots to encrypted
volumes that can only be unlocked from the initrd with
<citerefentry><refentrytitle>systemd-cryptenroll</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
by using the <option>--tpm2-public-key-policyref=initrd</option> option. The extra signatures reuse
the first <varname>PCRPrivateKey=</varname>/<option>--pcr-private-key=</option>, hence one must be
specified, unless <option>--policy-digest</option> is used to generate the policies for offline
signing. Defaults to false.</para>
<xi:include href="version-info.xml" xpointer="v262"/></listitem>
</varlistentry>
<varlistentry>
<term><varname>SecureBootSigningTool=<replaceable>SIGNER</replaceable></varname></term>
<term><option>--signtool=<replaceable>SIGNER</replaceable></option></term>