Paul Meyer
224a37a47b
So far the variable was set as soon as one of the SMBIOS structures (types 1, 2 and 11) was measured, and a later failure on another only logged.The original intent was to prevent sd-stub from measuring these things a second time after sd-boot already did. This PR adds a second consumer: in a confidential VM, PID 1 takes the variable as confirmation that the SMBIOS OEM strings are covered by PCR 1 before it imports credentials from them. Make the loader provide that guarantee and leave the variable unset if any structure could not be measured, which also matches how the documentation already describes it. The effect on the existing consumer is limited to boots with a measurement failure: when sd-boot fails to measure some of the structs and then chainloads sd-stub, sd-stub measures the structs sd-boot was able to measure a second time. Previously it would have left the incomplete measurement as is. In that situation PCR 1 already didn't match the expected value before (events missing), and after this change it still won't (additional events), so anything bound to it, such as a pcrlock policy, does not match either way. Signed-off-by: Paul Meyer <katexochen0@gmail.com>
System and Service Manager
Details
Most documentation is available on systemd's website.
Assorted, older, general information about systemd can be found in the systemd Wiki.
Information about build requirements is provided in the README file.
Consult our NEWS file for information about what's new in the most recent systemd versions.
Please see the Code Map for information about this repository's layout and content.
Please see the Hacking guide for information on how to hack on systemd and test your modifications.
Please see our Contribution Guidelines for more information about filing GitHub Issues and posting GitHub Pull Requests.
When preparing patches for systemd, please follow our Coding Style Guidelines.
If you are looking for support, please contact our mailing list, join our IRC channel #systemd on libera.chat or Matrix channel
Stable branches with backported patches are available in the stable repo.
We have a security bug bounty program sponsored by the Sovereign Tech Fund hosted on YesWeHack
Repositories with distribution packages built from git main are available on OBS, and also repositories with packages built from the latest stable release