SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

cryptsetup: Add fixate-volume-key option to pin the expected volume key hash

Browse Source 
The expected hash (SHA265 HMAC signature) uses the exact same algorithm which
is used to calculate sha256 PCR bank digest when 'tpm2-measure-pcr=' is used.
This commit is contained in:
Vitaly Kuznetsov
2026-01-19 17:49:39 +01:00
parent f99f843f24
commit 69fab29ec4
4 changed files with 131 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/shared/cryptsetup-util.h
+3
View File
@@ -66,6 +66,9 @@ int cryptsetup_set_minimal_pbkdf(struct crypt_device *cd);
int cryptsetup_get_token_as_json(struct crypt_device *cd, int idx, const char *verify_type, sd_json_variant **ret);
int cryptsetup_add_token_json(struct crypt_device *cd, sd_json_variant *v);
int cryptsetup_get_volume_key_prefix(struct crypt_device *cd, const char *volume_name, char **ret);
int cryptsetup_get_volume_key_id(struct crypt_device *cd, const char *volume_name, const void *volume_key,
size_t volume_key_size, char **ret);
#endif
int dlopen_cryptsetup(void);