Alberto Planas
4054e8128e
The OVMF UEFI firmware is measuring PK and KEK when secure boot is disabled, and those variables are absent. This can be checked via the event log to see that there are extensions for PCR 7 associated with PK and KEK events of type EV_EFI_VARIABLE_DRIVER_CONFIG. When running the "lock-secureboot-policy" verb, pcrlock complains that those variables are not found and refuse to generate the 240-secureboot-policy.pcrlock.d/generated.pcrlock file. The "TCG PC Client Platform Firmware Profile Specification Version 1.05 Revision 23"[1] from May 7, 2021, in section "3.3.4.8 PCR[7] - Secure Boot Policy Measurements", point 10.b: If reading a UEFI variable returns UEFI_NOT_FOUND, platform firmware SHALL measure the absence of the variable. The UEFI_VARIABLE_DATA.VariableDataLength field MUST be set to zero and UEFI_VARIABLE_DATA.VariableData field will have a size of zero. This patch mark those variables to be marked as "synthesize empty", generating the correct hash for those variables. Signed-off-by: Alberto Planas <aplanas@suse.com>
System and Service Manager
Details
Most documentation is available on systemd's web site.
Assorted, older, general information about systemd can be found in the systemd Wiki.
Information about build requirements is provided in the README file.
Consult our NEWS file for information about what's new in the most recent systemd versions.
Please see the Code Map for information about this repository's layout and content.
Please see the Hacking guide for information on how to hack on systemd and test your modifications.
Please see our Contribution Guidelines for more information about filing GitHub Issues and posting GitHub Pull Requests.
When preparing patches for systemd, please follow our Coding Style Guidelines.
If you are looking for support, please contact our mailing list, join our IRC channel #systemd on libera.chat or Matrix channel
Stable branches with backported patches are available in the stable repo.