shaba/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd.git synced 2024-12-25 01:34:28 +03:00
Code
008f23b7c5
systemd/man/systemd-tpm2-setup.service.xml

83 lines
3.3 KiB
XML
Raw Normal View History

tpm2-setup: add new early boot tool for initializing the SRK This adds an explicit service for initializing the TPM2 SRK. This is implicitly also done by systemd-cryptsetup, hence strictly speaking redundant, but doing this early has the benefit that we can parallelize this in a nicer way. This also write a copy of the SRK public key in PEM format to /run/ + /var/lib/, thus pinning the disk image to the TPM. Making the SRK public key is also useful for allowing easy offline encryption for a specific TPM. Sooner or later we should probably grow what this service does, the above is just the first step. For example, the service should probably offer the ability to reset the TPM (clear the owner hierarchy?) on a factory reset, if such a policy is needed. And we might want to install some default AK (?). Fixes: #27986 Also see: #22637
2023-09-26 22:25:53 +03:00
<?xml version="1.0"?>
<!--*-nxml-*-->
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
man: use same version in public and system ident.
2023-12-25 17:48:33 +03:00
"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd">
tpm2-setup: add new early boot tool for initializing the SRK This adds an explicit service for initializing the TPM2 SRK. This is implicitly also done by systemd-cryptsetup, hence strictly speaking redundant, but doing this early has the benefit that we can parallelize this in a nicer way. This also write a copy of the SRK public key in PEM format to /run/ + /var/lib/, thus pinning the disk image to the TPM. Making the SRK public key is also useful for allowing easy offline encryption for a specific TPM. Sooner or later we should probably grow what this service does, the above is just the first step. For example, the service should probably offer the ability to reset the TPM (clear the owner hierarchy?) on a factory reset, if such a policy is needed. And we might want to install some default AK (?). Fixes: #27986 Also see: #22637
2023-09-26 22:25:53 +03:00
<!-- SPDX-License-Identifier: LGPL-2.1-or-later -->
<refentry id="systemd-tpm2-setup.service" conditional='ENABLE_BOOTLOADER'
xmlns:xi="http://www.w3.org/2001/XInclude">
<refentryinfo>
<title>systemd-tpm2-setup.service</title>
<productname>systemd</productname>
</refentryinfo>
<refmeta>
<refentrytitle>systemd-tpm2-setup.service</refentrytitle>
<manvolnum>8</manvolnum>
</refmeta>
<refnamediv>
<refname>systemd-tpm2-setup.service</refname>
<refname>systemd-tpm2-setup-early.service</refname>
<refname>systemd-tpm2-setup</refname>
<refpurpose>Set up the TPM2 Storage Root Key (SRK) at boot</refpurpose>
</refnamediv>
<refsynopsisdiv>
<para><filename>systemd-tpm2-setup.service</filename></para>
<para><filename>/usr/lib/systemd/systemd-tpm2-setup</filename></para>
</refsynopsisdiv>
<refsect1>
<title>Description</title>
<para><filename>systemd-tpm2-setup.service</filename> and
<filename>systemd-tpm2-setup-early.service</filename> are services that generate the Storage Root Key
(SRK) if it hasn't been generated yet, and stores it in the TPM.</para>
<para>The services will store the public key of the SRK key pair in a PEM file in
<filename>/run/systemd/tpm2-srk-public-key.pem</filename> and
man: fix a few issues in manpage fix: #31482 Signed-off-by: cunshunxia <cunshunxia@tencent.com>
2024-02-29 05:46:25 +03:00
<filename>/var/lib/systemd/tpm2-srk-public-key.pem</filename>. They will also store it in TPM2B_PUBLIC
tpm2-setup: also save the SRK to the file system in TPM2_PUBLIC format We already save it in PEM format, also store it TPM2_PUBLIC format next to it. This is useful for usage with systemd-cryptenroll's --tpm2-device-key= switch.
2023-11-09 00:24:33 +03:00
format in <filename>/run/systemd/tpm2-srk-public-key.tpm2_public</filename> and
<filename>/var/lib/systemd/tpm2-srk-public-key.tpm2b_public</filename>.</para>
tpm2-setup: add new early boot tool for initializing the SRK This adds an explicit service for initializing the TPM2 SRK. This is implicitly also done by systemd-cryptsetup, hence strictly speaking redundant, but doing this early has the benefit that we can parallelize this in a nicer way. This also write a copy of the SRK public key in PEM format to /run/ + /var/lib/, thus pinning the disk image to the TPM. Making the SRK public key is also useful for allowing easy offline encryption for a specific TPM. Sooner or later we should probably grow what this service does, the above is just the first step. For example, the service should probably offer the ability to reset the TPM (clear the owner hierarchy?) on a factory reset, if such a policy is needed. And we might want to install some default AK (?). Fixes: #27986 Also see: #22637
2023-09-26 22:25:53 +03:00
<para><filename>systemd-tpm2-setup-early.service</filename> runs very early at boot (possibly in the
tpm2-setup: also save the SRK to the file system in TPM2_PUBLIC format We already save it in PEM format, also store it TPM2_PUBLIC format next to it. This is useful for usage with systemd-cryptenroll's --tpm2-device-key= switch.
2023-11-09 00:24:33 +03:00
initrd), and writes the SRK public key to <filename>/run/systemd/tpm2-srk-public-key.*</filename> (as
tpm2-setup: add new early boot tool for initializing the SRK This adds an explicit service for initializing the TPM2 SRK. This is implicitly also done by systemd-cryptsetup, hence strictly speaking redundant, but doing this early has the benefit that we can parallelize this in a nicer way. This also write a copy of the SRK public key in PEM format to /run/ + /var/lib/, thus pinning the disk image to the TPM. Making the SRK public key is also useful for allowing easy offline encryption for a specific TPM. Sooner or later we should probably grow what this service does, the above is just the first step. For example, the service should probably offer the ability to reset the TPM (clear the owner hierarchy?) on a factory reset, if such a policy is needed. And we might want to install some default AK (?). Fixes: #27986 Also see: #22637
2023-09-26 22:25:53 +03:00
<filename>/var/</filename> is generally not accessible this early yet), while
<filename>systemd-tpm2-setup.service</filename> runs during a later boot phase and saves the public key
tpm2-setup: also save the SRK to the file system in TPM2_PUBLIC format We already save it in PEM format, also store it TPM2_PUBLIC format next to it. This is useful for usage with systemd-cryptenroll's --tpm2-device-key= switch.
2023-11-09 00:24:33 +03:00
to <filename>/var/lib/systemd/tpm2-srk-public-key.*</filename>.</para>
tpm2-setup: add new early boot tool for initializing the SRK This adds an explicit service for initializing the TPM2 SRK. This is implicitly also done by systemd-cryptsetup, hence strictly speaking redundant, but doing this early has the benefit that we can parallelize this in a nicer way. This also write a copy of the SRK public key in PEM format to /run/ + /var/lib/, thus pinning the disk image to the TPM. Making the SRK public key is also useful for allowing easy offline encryption for a specific TPM. Sooner or later we should probably grow what this service does, the above is just the first step. For example, the service should probably offer the ability to reset the TPM (clear the owner hierarchy?) on a factory reset, if such a policy is needed. And we might want to install some default AK (?). Fixes: #27986 Also see: #22637
2023-09-26 22:25:53 +03:00
</refsect1>
<refsect1>
<title>Files</title>
<variablelist>
<varlistentry>
<term><filename>/run/systemd/tpm2-srk-public-key.pem</filename></term>
tpm2-setup: also save the SRK to the file system in TPM2_PUBLIC format We already save it in PEM format, also store it TPM2_PUBLIC format next to it. This is useful for usage with systemd-cryptenroll's --tpm2-device-key= switch.
2023-11-09 00:24:33 +03:00
<term><filename>/run/systemd/tpm2-srk-public-key.tpm2b_public</filename></term>
tpm2-setup: add new early boot tool for initializing the SRK This adds an explicit service for initializing the TPM2 SRK. This is implicitly also done by systemd-cryptsetup, hence strictly speaking redundant, but doing this early has the benefit that we can parallelize this in a nicer way. This also write a copy of the SRK public key in PEM format to /run/ + /var/lib/, thus pinning the disk image to the TPM. Making the SRK public key is also useful for allowing easy offline encryption for a specific TPM. Sooner or later we should probably grow what this service does, the above is just the first step. For example, the service should probably offer the ability to reset the TPM (clear the owner hierarchy?) on a factory reset, if such a policy is needed. And we might want to install some default AK (?). Fixes: #27986 Also see: #22637
2023-09-26 22:25:53 +03:00
tpm2-setup: also save the SRK to the file system in TPM2_PUBLIC format We already save it in PEM format, also store it TPM2_PUBLIC format next to it. This is useful for usage with systemd-cryptenroll's --tpm2-device-key= switch.
2023-11-09 00:24:33 +03:00
<listitem><para>The SRK public key in PEM and TPM2B_PUBLIC format, written during early boot.</para>
man: add version info for newly added systemd-tpm2-setup.service
2023-10-01 13:49:44 +03:00
<xi:include href="version-info.xml" xpointer="v255"/></listitem>
tpm2-setup: add new early boot tool for initializing the SRK This adds an explicit service for initializing the TPM2 SRK. This is implicitly also done by systemd-cryptsetup, hence strictly speaking redundant, but doing this early has the benefit that we can parallelize this in a nicer way. This also write a copy of the SRK public key in PEM format to /run/ + /var/lib/, thus pinning the disk image to the TPM. Making the SRK public key is also useful for allowing easy offline encryption for a specific TPM. Sooner or later we should probably grow what this service does, the above is just the first step. For example, the service should probably offer the ability to reset the TPM (clear the owner hierarchy?) on a factory reset, if such a policy is needed. And we might want to install some default AK (?). Fixes: #27986 Also see: #22637
2023-09-26 22:25:53 +03:00
</varlistentry>
<varlistentry>
<term><filename>/var/lib/systemd/tpm2-srk-public-key.pem</filename></term>
tpm2-setup: also save the SRK to the file system in TPM2_PUBLIC format We already save it in PEM format, also store it TPM2_PUBLIC format next to it. This is useful for usage with systemd-cryptenroll's --tpm2-device-key= switch.
2023-11-09 00:24:33 +03:00
<term><filename>/var/lib/systemd/tpm2-srk-public-key.tpm2_public</filename></term>
tpm2-setup: add new early boot tool for initializing the SRK This adds an explicit service for initializing the TPM2 SRK. This is implicitly also done by systemd-cryptsetup, hence strictly speaking redundant, but doing this early has the benefit that we can parallelize this in a nicer way. This also write a copy of the SRK public key in PEM format to /run/ + /var/lib/, thus pinning the disk image to the TPM. Making the SRK public key is also useful for allowing easy offline encryption for a specific TPM. Sooner or later we should probably grow what this service does, the above is just the first step. For example, the service should probably offer the ability to reset the TPM (clear the owner hierarchy?) on a factory reset, if such a policy is needed. And we might want to install some default AK (?). Fixes: #27986 Also see: #22637
2023-09-26 22:25:53 +03:00
tpm2-setup: also save the SRK to the file system in TPM2_PUBLIC format We already save it in PEM format, also store it TPM2_PUBLIC format next to it. This is useful for usage with systemd-cryptenroll's --tpm2-device-key= switch.
2023-11-09 00:24:33 +03:00
<listitem><para>The SRK public key in PEM and TPM2B_PUBLIC format, written during later boot (once
man: add version info for newly added systemd-tpm2-setup.service
2023-10-01 13:49:44 +03:00
<filename>/var/</filename> is available).</para>
<xi:include href="version-info.xml" xpointer="v255"/></listitem>
tpm2-setup: add new early boot tool for initializing the SRK This adds an explicit service for initializing the TPM2 SRK. This is implicitly also done by systemd-cryptsetup, hence strictly speaking redundant, but doing this early has the benefit that we can parallelize this in a nicer way. This also write a copy of the SRK public key in PEM format to /run/ + /var/lib/, thus pinning the disk image to the TPM. Making the SRK public key is also useful for allowing easy offline encryption for a specific TPM. Sooner or later we should probably grow what this service does, the above is just the first step. For example, the service should probably offer the ability to reset the TPM (clear the owner hierarchy?) on a factory reset, if such a policy is needed. And we might want to install some default AK (?). Fixes: #27986 Also see: #22637
2023-09-26 22:25:53 +03:00
</varlistentry>
</variablelist>
</refsect1>
<refsect1>
<title>See Also</title>
<para>
<citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>
</para>
</refsect1>
</refentry>
Copy Permalink