SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

units: Run systemd-pcrnvdone in initrd

Browse Source 
The measurement that systemd-pcrnvdone corresponds to
`src/pcrlock/pcrlock.d/770-nvpcr-separator.pcrlock`, and 770 is supposed to
happen in the initrd (which ends at 800).
This commit is contained in:
Valentin David
2026-06-04 11:23:59 +01:00
committed by Luca Boccassi
parent 273267cbad
commit 856ab04a29
2 changed files with 8 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/TPM2_PCR_MEASUREMENTS.md
+3 -3
View File
@@ -265,7 +265,7 @@ on-the-fly by `systemd-stub`).
### PCR 9, NvPCR Initializations
The `systemd-tpm2-setup.service` service initializes any NvPCRs defined via
The `systemd-tpm2-setup-early.service` service initializes any NvPCRs defined via
`*.nvpcr` files. For each initialized NvPCR it will measure an event into PCR
9.
@@ -341,8 +341,8 @@ single-line JSON. Example string:
### PCR 9, NvPCR initialization separator
After completion of `systemd-tpm2-setup.service` (which initializes all NvPCRs
and measures their initial state) at arly boot the `systemd-pcrnvdone.service`
After completion of `systemd-tpm2-setup-early.service` (which initializes all NvPCRs
and measures their initial state) at early boot the `systemd-pcrnvdone.service`
service will measure a separator event into PCR 9, isolating the early-boot
NvPCR initializations from any later additions.