mirror of
https://github.com/systemd/systemd.git
synced 2026-08-09 01:20:53 +00:00
27b7fb9b20
Bind the io.systemd.SysUpdate.Notify.OnCompletedUpdate() method in the pcrlock Varlink server and hook a socket into /run/systemd/sysupdate/notify/ via systemd-sysupdate-notify-pcrlock.socket, enabled by default via the preset. When sysupdate signals a completed update, we unconditionally re-run make-policy, since the set of measured components may have changed.
30 lines
834 B
SYSTEMD
30 lines
834 B
SYSTEMD
# SPDX-License-Identifier: LGPL-2.1-or-later
|
|
#
|
|
# This file is part of systemd.
|
|
#
|
|
# systemd is free software; you can redistribute it and/or modify it
|
|
# under the terms of the GNU Lesser General Public License as published by
|
|
# the Free Software Foundation; either version 2.1 of the License, or
|
|
# (at your option) any later version.
|
|
|
|
[Unit]
|
|
Description=Recompute TPM PCR Policy on Completed System Update
|
|
Documentation=man:systemd-pcrlock(8)
|
|
DefaultDependencies=no
|
|
After=tpm2.target
|
|
Before=sockets.target
|
|
ConditionSecurity=measured-uki
|
|
|
|
[Socket]
|
|
ListenStream=/run/systemd/sysupdate/notify/io.systemd.PCRLock
|
|
FileDescriptorName=varlink
|
|
SocketMode=0644
|
|
Accept=yes
|
|
MaxConnectionsPerSource=16
|
|
XAttrEntryPoint=user.varlink=entrypoint
|
|
XAttrListen=user.varlink=listen
|
|
XAttrAccept=user.varlink=server
|
|
|
|
[Install]
|
|
WantedBy=sockets.target
|