mirror of
https://github.com/systemd/systemd
synced 2025-10-05 16:03:15 +02:00
PCR extensions are supposed to be useful for "destroying" the ability to access TPM bound secrets. Hence, if for some reason we fail to extend a PCR, it's safer to just reboot, instead of going on without the extension, leaving secrets potentially accessible which should not be accessible. Note that the services exit gracefully if no TPM is found, hence this should not be triggered on TPM-less systems. However, this enforces that if there is a TPM that is accessible to Linux and that works properly, the PCR measurement must complete too. Inspired by this thread: https://lists.freedesktop.org/archives/systemd-devel/2025-March/051244.html
25 lines
753 B
SYSTEMD
25 lines
753 B
SYSTEMD
# SPDX-License-Identifier: LGPL-2.1-or-later
|
|
#
|
|
# This file is part of systemd.
|
|
#
|
|
# systemd is free software; you can redistribute it and/or modify it
|
|
# under the terms of the GNU Lesser General Public License as published by
|
|
# the Free Software Foundation; either version 2.1 of the License, or
|
|
# (at your option) any later version.
|
|
|
|
[Unit]
|
|
Description=TPM PCR Machine ID Measurement
|
|
Documentation=man:systemd-pcrmachine.service(8)
|
|
DefaultDependencies=no
|
|
Conflicts=shutdown.target
|
|
After=tpm2.target
|
|
Before=sysinit.target shutdown.target
|
|
ConditionPathExists=!/etc/initrd-release
|
|
ConditionSecurity=measured-uki
|
|
FailureAction=reboot-force
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
RemainAfterExit=yes
|
|
ExecStart={{LIBEXECDIR}}/systemd-pcrextend --graceful --machine-id
|