Lennart Poettering
64fd94faa0
Let's bubble up failures all the way until they reach the services, but then let's carefully gracefully handle some of them, that are about issues not immediately actionable to the admin, even if they are potentially quite problematic.
32 lines
1.2 KiB
Plaintext
32 lines
1.2 KiB
Plaintext
# SPDX-License-Identifier: LGPL-2.1-or-later
|
|
#
|
|
# This file is part of systemd.
|
|
#
|
|
# systemd is free software; you can redistribute it and/or modify it
|
|
# under the terms of the GNU Lesser General Public License as published by
|
|
# the Free Software Foundation; either version 2.1 of the License, or
|
|
# (at your option) any later version.
|
|
|
|
[Unit]
|
|
Description=TPM SRK Setup
|
|
Documentation=man:systemd-tpm2-setup.service(8)
|
|
DefaultDependencies=no
|
|
Conflicts=shutdown.target
|
|
After=tpm2.target systemd-tpm2-setup-early.service systemd-remount-fs.service
|
|
Before=sysinit.target shutdown.target
|
|
RequiresMountsFor=/var/lib/systemd
|
|
ConditionSecurity=measured-uki
|
|
ConditionPathExists=!/etc/initrd-release
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
RemainAfterExit=yes
|
|
ExecStart={{LIBEXECDIR}}/systemd-tpm2-setup --graceful
|
|
|
|
# The tool returns EX_PROTOCOL if the TPM cannot be accessed due to an authorization failure and we can't generate an SRK.
|
|
SuccessExitStatus=PROTOCOL
|
|
# The tool returns EX_UNAVAILABLE if some key functionality (e.g. NvPCR) support is not available in the TPM device.
|
|
SuccessExitStatus=UNAVAILABLE
|
|
# The tool returns EX_CANTCREAT if the NV index space is exhausted.
|
|
SuccessExitStatus=CANTCREAT
|