Paul Meyer
257be02c20
TPM2_PolicyOR() takes at most eight branch digests (the TPM's TPML_DIGEST is fixed at eight elements). pcrlock hits this limit as soon as a PCR has more than eight predicted values, for example when several kernels or boot loader versions are covered by a single policy. It then fails with E2BIG. Lift the limit by nesting PolicyORs into a balanced tree with a fanout of eight, as the TCG TSS JSON policy format prescribes for more than eight branches: the leaves are the actual branches and every layer above them contains only PolicyORs, so all leaves end up at the same depth. Each level is partitioned evenly, which avoids pointless single-branch ORs. The tree is materialized by a helper shared between the calculating (tpm2_calculate_policy_or()) and the submitting (tpm2_policy_or()) side, so sealing and unsealing derive the exact same digests from the same branch list. For eight or fewer branches the previous flat code path is used unchanged, which keeps existing policies and sealed PINs working. Every extra level costs one more TPM round trip during unseal, hence the nesting depth is capped at TPM2_POLICY_OR_MAX_DEPTH (five, i.e. up to 8^5 = 32768 alternatives per PCR). If that's not enough for SUSE, we can discuss it :-) cc @aplanas This also drops the hard "more than 8 alternatives per PCR" rejection from the super PCR policy calculation and submission. I was not able to run the integration testing yet with mkosi due to some NixOS stuff, sorry!
System and Service Manager
Details
Most documentation is available on systemd's website.
Assorted, older, general information about systemd can be found in the systemd Wiki.
Information about build requirements is provided in the README file.
Consult our NEWS file for information about what's new in the most recent systemd versions.
Please see the Code Map for information about this repository's layout and content.
Please see the Hacking guide for information on how to hack on systemd and test your modifications.
Please see our Contribution Guidelines for more information about filing GitHub Issues and posting GitHub Pull Requests.
When preparing patches for systemd, please follow our Coding Style Guidelines.
If you are looking for support, please contact our mailing list, join our IRC channel #systemd on libera.chat or Matrix channel
Stable branches with backported patches are available in the stable repo.
We have a security bug bounty program sponsored by the Sovereign Tech Fund hosted on YesWeHack
Repositories with distribution packages built from git main are available on OBS, and also repositories with packages built from the latest stable release