mirror of
https://github.com/systemd/systemd.git
synced 2026-08-09 17:38:42 +00:00
cd911bec6e
So far we always conditioned our TPM magic on the UKI having detected TPM support in the firmware. This is a bit limiting when we want to support a software TPM that is not visible to the firmware. Hence let's split this up, and add a separate control that can be set via the kernel command line. However, as before, let's by default inherit the firmare TPM discovery state into it, to retain the current behaviour unless overriden. With this in place, boot with "systemd.tpm2_measured_os=1 systemd.tpm2_software_fallback=1" on the kernel cmdline to get the swtpm fallback and then a measured OS based on it.
26 lines
797 B
SYSTEMD
26 lines
797 B
SYSTEMD
# SPDX-License-Identifier: LGPL-2.1-or-later
|
|
#
|
|
# This file is part of systemd.
|
|
#
|
|
# systemd is free software; you can redistribute it and/or modify it
|
|
# under the terms of the GNU Lesser General Public License as published by
|
|
# the Free Software Foundation; either version 2.1 of the License, or
|
|
# (at your option) any later version.
|
|
|
|
[Unit]
|
|
Description=TPM PCR File System Measurement of %f
|
|
Documentation=man:systemd-pcrfs@.service(8)
|
|
DefaultDependencies=no
|
|
BindsTo=%i.mount
|
|
Conflicts=shutdown.target
|
|
After=%i.mount tpm2.target systemd-pcrfs-root.service
|
|
Before=shutdown.target
|
|
ConditionPathExists=!/etc/initrd-release
|
|
ConditionSecurity=measured-os
|
|
FailureAction=reboot-force
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
RemainAfterExit=yes
|
|
ExecStart={{LIBEXECDIR}}/systemd-pcrextend --graceful --file-system=%f
|