SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

pcrlock: recompute PCR policy on completed system update

Browse Source 
Bind the io.systemd.SysUpdate.Notify.OnCompletedUpdate() method in the
pcrlock Varlink server and hook a socket into
/run/systemd/sysupdate/notify/ via systemd-sysupdate-notify-pcrlock.socket,
enabled by default via the preset. When sysupdate signals a completed
update, we unconditionally re-run make-policy, since the set of measured
components may have changed.
This commit is contained in:
Lennart Poettering
2026-06-24 13:05:34 +02:00
parent d36bdc9467
commit 27b7fb9b20
5 changed files with 89 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
presets/90-systemd.preset
+1
View File
@@ -40,6 +40,7 @@ enable systemd-report-sign-tsm.socket
enable systemd-report.socket
enable systemd-resolved.service
enable systemd-sysext.service
enable systemd-sysupdate-notify-pcrlock.socket
enable systemd-timesyncd.service
enable systemd-tpm2-clear.service
enable systemd-userdbd.socket