Lennart Poettering
eaeeae6598
This makes sure we don't use the "hardware" or "verity" nvpcrs before the NV anchor measurement is done. This is mostly to avoid confusing output, and to indirectly ensure the nvpcr allocation in tpm2-setup is the load bearing one, but it should not be load bearing for security afaics.
25 lines
794 B
Plaintext
25 lines
794 B
Plaintext
# SPDX-License-Identifier: LGPL-2.1-or-later
|
|
#
|
|
# This file is part of systemd.
|
|
#
|
|
# systemd is free software; you can redistribute it and/or modify it
|
|
# under the terms of the GNU Lesser General Public License as published by
|
|
# the Free Software Foundation; either version 2.1 of the License, or
|
|
# (at your option) any later version.
|
|
|
|
[Unit]
|
|
Description=TPM NvPCR Product ID Measurement
|
|
Documentation=man:systemd-pcrproduct.service(8)
|
|
DefaultDependencies=no
|
|
Conflicts=shutdown.target
|
|
After=tpm2.target systemd-pcrnvdone.service
|
|
Before=sysinit.target shutdown.target
|
|
RequiresMountsFor=/var/lib/systemd/nvpcr
|
|
ConditionPathExists=!/etc/initrd-release
|
|
ConditionSecurity=measured-os
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
RemainAfterExit=yes
|
|
ExecStart={{LIBEXECDIR}}/systemd-pcrextend --graceful --product-id
|