SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

units: Run systemd-pcrnvdone in initrd

Browse Source 
The measurement that systemd-pcrnvdone corresponds to
`src/pcrlock/pcrlock.d/770-nvpcr-separator.pcrlock`, and 770 is supposed to
happen in the initrd (which ends at 800).
This commit is contained in:
Valentin David
2026-06-04 11:23:59 +01:00
committed by Luca Boccassi
parent 273267cbad
commit 856ab04a29
2 changed files with 8 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/TPM2_PCR_MEASUREMENTS.md
+3 -3
View File
@@ -265,7 +265,7 @@ on-the-fly by `systemd-stub`).
### PCR 9, NvPCR Initializations ### PCR 9, NvPCR Initializations
The `systemd-tpm2-setup.service` service initializes any NvPCRs defined via The `systemd-tpm2-setup-early.service` service initializes any NvPCRs defined via
`*.nvpcr` files. For each initialized NvPCR it will measure an event into PCR `*.nvpcr` files. For each initialized NvPCR it will measure an event into PCR
9. 9.
@@ -341,8 +341,8 @@ single-line JSON. Example string:
### PCR 9, NvPCR initialization separator ### PCR 9, NvPCR initialization separator
After completion of `systemd-tpm2-setup.service` (which initializes all NvPCRs After completion of `systemd-tpm2-setup-early.service` (which initializes all NvPCRs
and measures their initial state) at arly boot the `systemd-pcrnvdone.service` and measures their initial state) at early boot the `systemd-pcrnvdone.service`
service will measure a separator event into PCR 9, isolating the early-boot service will measure a separator event into PCR 9, isolating the early-boot
NvPCR initializations from any later additions. NvPCR initializations from any later additions.
units/systemd-pcrnvdone.service.in
+5 -4
View File
@@ -11,11 +11,12 @@
Description=TPM PCR NvPCR Initialization Separator Description=TPM PCR NvPCR Initialization Separator
Documentation=man:systemd-pcrnvdone.service(8) Documentation=man:systemd-pcrnvdone.service(8)
DefaultDependencies=no DefaultDependencies=no
Conflicts=shutdown.target Conflicts=shutdown.target initrd-switch-root.target
After=systemd-tpm2-setup-early.service systemd-tpm2-setup.service After=tpm2.target
Before=sysinit.target cryptsetup-pre.target cryptsetup.target shutdown.target After=systemd-tpm2-setup-early.service
Before=sysinit.target cryptsetup-pre.target cryptsetup.target shutdown.target initrd-switch-root.target
ConditionSecurity=measured-os ConditionSecurity=measured-os
ConditionPathExists=!/etc/initrd-release ConditionPathExists=/etc/initrd-release
FailureAction=reboot-force FailureAction=reboot-force
[Service] [Service]