SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

gpt-auto-generator: enable nvpcr logic by default

Browse Source 
Let's enable this kind of measurement by default if people buy into UKIs
and stuff, just like volume key measurement is now enabled by default.
This commit is contained in:
Lennart Poettering
2026-02-17 22:00:14 +01:00
parent 85d7fb2247
commit a450fab9c6
2 changed files with 27 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
man/systemd-gpt-auto-generator.xml
+7 -3
View File
@@ -272,9 +272,13 @@
<para>If the system was booted via
<citerefentry><refentrytitle>systemd-stub</refentrytitle><manvolnum>7</manvolnum></citerefentry> and the
stub reported to userspace that the kernel image was measured to a TPM2 PCR, then any discovered root and
<filename>/var/</filename> volume identifiers (and volume encryption key in case it is encrypted) will be
automatically measured into PCR 15 on activation, via
<citerefentry><refentrytitle>systemd-pcrfs@.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>.</para>
<filename>/var/</filename> volume identifiers (and volume encryption keys, in case they are encrypted)
will be automatically measured into PCR 15 on activation, via
<citerefentry><refentrytitle>systemd-pcrfs@.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>. Moreover,
information about the LUKS key slot used to unlock the volume is measured into NvPCR
<literal>cryptsetup</literal>. Finally, if the root or <filename>/usr/</filename> partition is protected
via Verity its root hash and the serial/issuer of the key used for the provided root hash signature (if
any) are measured into the NvPCR <literal>verity</literal>.</para>
<para>Mount constraint metadata contained in the file systems is validated by pulling in
<citerefentry><refentrytitle>systemd-validatefs@.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>
src/gpt-auto-generator/gpt-auto-generator.c
+20 -4
View File
@@ -190,7 +190,8 @@ static int add_veritysetup(
const char *id,
const char *data_what,
const char *hash_what,
const char *mount_opts) {
const char *mount_opts,
MountPointFlags flags) {
#if HAVE_LIBCRYPTSETUP
int r;
@@ -233,13 +234,26 @@ static int add_veritysetup(
"After=%1$s %2$s\n",
dd, dh);
_cleanup_free_ char *options =
strdup("root-hash-signature=auto"); /* auto means: derive signature from udev property ID_DISSECT_PART_ROOTHASH_SIG */
if (!options)
return log_oom();
if (FLAGS_SET(flags, MOUNT_MEASURE)) {
r = efi_measured_uki(LOG_WARNING);
if (r > 0 && !strextend_with_separator(&options, ",", "tpm2-measure-nvpcr=yes"))
return log_oom();
if (r == 0)
log_debug("Will not measure root hash/signature of volume '%s', not booted via systemd-stub with measurements enabled.", id);
}
r = generator_write_veritysetup_service_section(
f,
id,
data_what,
hash_what,
/* roothash= */ NULL, /* NULL means: derive root hash from udev property ID_DISSECT_PART_ROOTHASH */
"root-hash-signature=auto"); /* auto means: derive signature from udev property ID_DISSECT_PART_ROOTHASH_SIG */
options);
if (r < 0)
return r;
@@ -871,7 +885,8 @@ static int add_root_mount(void) {
"root",
"/dev/disk/by-designator/root-verity-data",
"/dev/disk/by-designator/root-verity",
arg_root_options);
arg_root_options,
MOUNT_MEASURE);
if (r < 0)
return r;
}
@@ -952,7 +967,8 @@ static int add_usr_mount(void) {
"usr",
"/dev/disk/by-designator/usr-verity-data",
"/dev/disk/by-designator/usr-verity",
arg_usr_options);
arg_usr_options,
MOUNT_MEASURE);
if (r < 0)
return r;
}