Lennart Poettering
720848d368
In various scenarios it's useful to be able to run a software TPM as fallback on a machine if it doesn't natively have a hardware for it, in order to provide somewhat systematic interfacing for legacy machines. This adds the infrastructure for it. Relevant parts: 1. On EFI systems sd-stub will now generate a random secret on first boot and store it in a persistent NV variable, which is marked inaccessible to the OS. It then derives a per-OS secret from that which is passed to the OS via the initrd logic. This is generally useful, but in particular is intended to secure the software TPM at least a bit: it provides better security than nothing (i.e. the only protection in place is that the firmwrae protections work, but this is also what shim relies on, hence maybe not too bad), and allows swtpm to encrypt its storage with something. 2. systemd-tpm2-generator is extended to optionally start an swtpm if no tpm hw is detected. Because this is of course a major downgrade in security, this has to be requested explicitly at boot via a kernel cmdline switch. 3. This optionally mounts the ESP from the initrd. This is general infrastructure, and has been requested before, but is particularly interesting in the context of software TPMs: the state needs to be stored somewhere, and that before the rootfs can be unlocked. 4. This introduces a special new separator measurement for PCRs 0-7 that isolates all measurements from pre-os/uefi world from those done by the OS. I added this for three reasons: - in the swtpm case we'll not have any pre-os/uefi measurements, and we need to be able to determine cleanly that this is the case. this hence is supposed to play a similar role as the usual firmware separator measurement, that however cleanly fixates to the PCRs even the case where the firmware measurements don't exist at all - this is a very comprehensive fix for #40567 - not all firmwares generate the firmware separator at all, but it is essential to seal off firmware variables from OS generated ones. This can fill the void to some degree. 6. This introduces a new kernel cmdline switch systemd.tpm2-measured-os=1, which allows force enabling all our measurement logic, even if UKI TPM measurements are not done. This is supposed to be used for the swtpm case so that one gets all the measurements even without having the early boot verified boot chain in place. Benefits of all this: systems that care about TPMs have a (lower security) compat glue in place that allows supporting legacy hw the same way as modern hw in many ways, so that remote attestation and other uses can reasonably work with the same codepaths. Also see: https://github.com/lxc/incus-os/pull/667 regarding prior similar work. Fixes: #40567
System and Service Manager
Details
Most documentation is available on systemd's web site.
Assorted, older, general information about systemd can be found in the systemd Wiki.
Information about build requirements is provided in the README file.
Consult our NEWS file for information about what's new in the most recent systemd versions.
Please see the Code Map for information about this repository's layout and content.
Please see the Hacking guide for information on how to hack on systemd and test your modifications.
Please see our Contribution Guidelines for more information about filing GitHub Issues and posting GitHub Pull Requests.
When preparing patches for systemd, please follow our Coding Style Guidelines.
If you are looking for support, please contact our mailing list, join our IRC channel #systemd on libera.chat or Matrix channel
Stable branches with backported patches are available in the stable repo.
We have a security bug bounty program sponsored by the Sovereign Tech Fund hosted on YesWeHack
Repositories with distribution packages built from git main are available on OBS, and also repositories with packages built from the latest stable release