mirror of
https://github.com/systemd/systemd.git
synced 2026-11-06 05:17:24 +00:00
Chris Coulson
e846bbad04
Currently systemd-tpm2-setup will fail if NvPCR initialization doesn't succeed, either because the currently booted UKI carries no PCR public key, or it carries no appropriate signed policy (one with the "initrd" policy reference). In addition to this, systemd-pcrextend will subsequently fail because it also fails to initialize the NvPCR it is requested to extend. This makes systemd-tpm2-setup return EX_CONFIG in these scenarios, with this marked as a successful exit status in the service unit file. In addition to this, systemd-pcrextend is updated to only attempt NvPCR initialization from the initrd (the only place it will succceed), and when called with --graceful, to not exit with an error code if the target NvPCR is uninitialized, and can't be initialized because of a missing PCR public key or appropriate signed policy. When called via Varlink, it will return the existing "NoSuchNvPCR" error. Note that I also removed some NvPCR initialization specific exit status codes from systemd-tpm2-setup.service.in, as these can only be returned via systemd-tpm2-setup-early.service. This should address the issues in https://github.com/systemd/systemd/issues/43848.
30 lines
1.1 KiB
Plaintext
30 lines
1.1 KiB
Plaintext
# SPDX-License-Identifier: LGPL-2.1-or-later
|
|
#
|
|
# This file is part of systemd.
|
|
#
|
|
# systemd is free software; you can redistribute it and/or modify it
|
|
# under the terms of the GNU Lesser General Public License as published by
|
|
# the Free Software Foundation; either version 2.1 of the License, or
|
|
# (at your option) any later version.
|
|
|
|
[Unit]
|
|
Description=TPM SRK Setup
|
|
Documentation=man:systemd-tpm2-setup.service(8)
|
|
DefaultDependencies=no
|
|
Conflicts=shutdown.target
|
|
After=tpm2.target systemd-tpm2-setup-early.service systemd-remount-fs.service
|
|
Before=sysinit.target shutdown.target
|
|
RequiresMountsFor=/var/lib/systemd
|
|
ConditionSecurity=measured-os
|
|
ConditionPathExists=!/etc/initrd-release
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
RemainAfterExit=yes
|
|
ExecStart={{LIBEXECDIR}}/systemd-tpm2-setup --graceful
|
|
|
|
# The tool returns EX_PROTOCOL if the TPM cannot be accessed due to an authorization failure and we can't generate an SRK.
|
|
SuccessExitStatus=PROTOCOL
|
|
# The tool returns EX_UNAVAILABLE if some key functionality (e.g. NvPCR) support is not available in the TPM device.
|
|
SuccessExitStatus=UNAVAILABLE
|