mirrors/systemd
0
0
Fork 0
mirror of https://github.com/systemd/systemd.git synced 2024-11-23 10:13:34 +08:00
Code Issues Packages Projects Releases Wiki Activity
d209e197f8
systemd/units/systemd-pcrphase-sysinit.service.in

25 lines
801 B
SYSTEMD
Raw Normal View History

pcrphase: add two additional phases This adds two more phases to the PCR boot phase logic: "sysinit" + "final". The "sysinit" one is placed between sysinit.target and basic.target. It's good to have a milestone in this place, since this is after all file systems/LUKS volumes are in place (which sooner or later should result in measurements of their own) and before services are started (where we should be able to rely on them to be complete). This is particularly useful to make certain secrets available for mounting secondary file systems, but making them unavailable later. This breaks API in a way (as measurements during runtime will change), but given that the pcrphase stuff wasn't realeased yet should be OK.
2022-10-15 02:53:42 +08:00
# SPDX-License-Identifier: LGPL-2.1-or-later
#
# This file is part of systemd.
#
# systemd is free software; you can redistribute it and/or modify it
# under the terms of the GNU Lesser General Public License as published by
# the Free Software Foundation; either version 2.1 of the License, or
# (at your option) any later version.
[Unit]
units: retitle systemd-pcrextend.{service,socket}, change TPM2→TPM I was looking at the logs in some bug and saw this: Mar 13 15:55:12 fedora systemd[1]: systemd-pcrmachine.service - TPM2 PCR Machine ID Measurement was skipped because of an unmet condition check (ConditionSecurity=measured-uki). Mar 13 15:55:12 fedora systemd[1]: Starting systemd-remount-fs.service - Remount Root and Kernel File Systems... Mar 13 15:55:12 fedora systemd[1]: systemd-tpm2-setup-early.service - TPM2 SRK Setup (Early) was skipped because of an unmet condition check (ConditionSecurity=measured-uki). This is overly technical, for most units we don't provide this level of detail about the implementation. So retitle the units to be more accessible. Also, the fact that it's a v. 2 of the TPM is not that important. We don't support TPM 1.2, but computers without TPM v2 are getting rare. For other units we don't advertise the version of hardware, and let's not do this here, to reduce some complexity.
2024-03-14 05:18:13 +08:00
Description=TPM PCR Barrier (Initialization)
pcrphase: add two additional phases This adds two more phases to the PCR boot phase logic: "sysinit" + "final". The "sysinit" one is placed between sysinit.target and basic.target. It's good to have a milestone in this place, since this is after all file systems/LUKS volumes are in place (which sooner or later should result in measurements of their own) and before services are started (where we should be able to rely on them to be complete). This is particularly useful to make certain secrets available for mounting secondary file systems, but making them unavailable later. This breaks API in a way (as measurements during runtime will change), but given that the pcrphase stuff wasn't realeased yet should be OK.
2022-10-15 02:53:42 +08:00
Documentation=man:systemd-pcrphase-sysinit.service(8)
DefaultDependencies=no
Conflicts=shutdown.target
units: add a tpm2.target synchronization point and small generator that pulls in Distributions apparently only compile a subset of TPM2 drivers into the kernel. For those not compiled it but provided as kmod we need a synchronization point: we must wait before the first TPM2 interaction until the driver is available and accessible. This adds a tpm2.target unit as such a synchronization point. It's ordered after /dev/tpmrm0, and is pulled in by a generator whenever we detect that the kernel reported a TPM2 to exist but we have no device for it yet. This should solve the issue, but might create problems: if there are TPM devices supported by firmware that we don't have Linux drivers for we'll hang for a bit. Hence let's add a kernel cmdline switch to disable (or alternatively force) this logic. Fixes: #30164
2023-11-25 01:01:56 +08:00
After=sysinit.target tpm2.target
pcrphase: add two additional phases This adds two more phases to the PCR boot phase logic: "sysinit" + "final". The "sysinit" one is placed between sysinit.target and basic.target. It's good to have a milestone in this place, since this is after all file systems/LUKS volumes are in place (which sooner or later should result in measurements of their own) and before services are started (where we should be able to rely on them to be complete). This is particularly useful to make certain secrets available for mounting secondary file systems, but making them unavailable later. This breaks API in a way (as measurements during runtime will change), but given that the pcrphase stuff wasn't realeased yet should be OK.
2022-10-15 02:53:42 +08:00
Before=basic.target shutdown.target
units: change assert to condition to skip running in initrd/os These units are also present in the initrd, so instead of an assert, just use a condition so they are skipped where they need to be skipped. Fixes https://github.com/systemd/systemd/issues/26358
2023-02-09 07:06:27 +08:00
ConditionPathExists=!/etc/initrd-release
units: move units over to ConditionSecurity=measured-uki
2023-09-27 18:13:26 +08:00
ConditionSecurity=measured-uki
pcrphase: add two additional phases This adds two more phases to the PCR boot phase logic: "sysinit" + "final". The "sysinit" one is placed between sysinit.target and basic.target. It's good to have a milestone in this place, since this is after all file systems/LUKS volumes are in place (which sooner or later should result in measurements of their own) and before services are started (where we should be able to rely on them to be complete). This is particularly useful to make certain secrets available for mounting secondary file systems, but making them unavailable later. This breaks API in a way (as measurements during runtime will change), but given that the pcrphase stuff wasn't realeased yet should be OK.
2022-10-15 02:53:42 +08:00
[Service]
Type=oneshot
RemainAfterExit=yes
pcrphase: rename binary to pcrextend The tool initially just measured the boot phase, but was subsequently extended to measure file system and machine IDs, too. At AllSystemsGo there were request to add more, and make the tool generically accessible. Hence, let's rename the binary (but not the pcrphase services), to make clear the tool is not just measureing the boot phase, but a lot of other things too. The tool is located in /usr/lib/ and still relatively new, hence let's just rename the binary and be done with it, while keeping the unit names stable. While we are at it, also move the tool out of src/boot/ and into its own src/pcrextend/ dir, since it's not really doing boot related stuff anymore.
2023-09-25 16:38:01 +08:00
ExecStart={{LIBEXECDIR}}/systemd-pcrextend --graceful sysinit
ExecStop={{LIBEXECDIR}}/systemd-pcrextend --graceful final
Reference in New Issue Copy Permalink