systemd/units/systemd-pcrfs-root.service.in

#  SPDX-License-Identifier: LGPL-2.1-or-later
#
#  This file is part of systemd.
#
#  systemd is free software; you can redistribute it and/or modify it
#  under the terms of the GNU Lesser General Public License as published by
#  the Free Software Foundation; either version 2.1 of the License, or
#  (at your option) any later version.

[Unit]
Description=TPM2 PCR Root File System Measurement
Documentation=man:systemd-pcrfs-root.service(8)
DefaultDependencies=no
Conflicts=shutdown.target
After=systemd-pcrmachine.service
Before=shutdown.target
ConditionPathExists=!/etc/initrd-release
ConditionSecurity=tpm2
ConditionPathExists=/sys/firmware/efi/efivars/StubPcrKernelImage-4a67b082-0a4c-41cf-b6c7-440b29bb8c4f

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart={{LIBEXECDIR}}/systemd-pcrextend --graceful --file-system=/
generators: optionally, measure file systems at boot If we use gpt-auto-generator, automatically measure root fs and /var. Otherwise, add x-systemd.measure option to request this. 2022-10-17 00:25:04 +03:00			`# SPDX-License-Identifier: LGPL-2.1-or-later`
			`#`
			`# This file is part of systemd.`
			`#`
			`# systemd is free software; you can redistribute it and/or modify it`
			`# under the terms of the GNU Lesser General Public License as published by`
			`# the Free Software Foundation; either version 2.1 of the License, or`
			`# (at your option) any later version.`

			`[Unit]`
			`Description=TPM2 PCR Root File System Measurement`
			`Documentation=man:systemd-pcrfs-root.service(8)`
			`DefaultDependencies=no`
			`Conflicts=shutdown.target`
			`After=systemd-pcrmachine.service`
			`Before=shutdown.target`
units: change assert to condition to skip running in initrd/os These units are also present in the initrd, so instead of an assert, just use a condition so they are skipped where they need to be skipped. Fixes https://github.com/systemd/systemd/issues/26358 2023-02-09 02:06:27 +03:00			`ConditionPathExists=!/etc/initrd-release`
generators: optionally, measure file systems at boot If we use gpt-auto-generator, automatically measure root fs and /var. Otherwise, add x-systemd.measure option to request this. 2022-10-17 00:25:04 +03:00			`ConditionSecurity=tpm2`
			`ConditionPathExists=/sys/firmware/efi/efivars/StubPcrKernelImage-4a67b082-0a4c-41cf-b6c7-440b29bb8c4f`

			`[Service]`
			`Type=oneshot`
			`RemainAfterExit=yes`
pcrphase: rename binary to pcrextend The tool initially just measured the boot phase, but was subsequently extended to measure file system and machine IDs, too. At AllSystemsGo there were request to add more, and make the tool generically accessible. Hence, let's rename the binary (but not the pcrphase services), to make clear the tool is not just measureing the boot phase, but a lot of other things too. The tool is located in /usr/lib/ and still relatively new, hence let's just rename the binary and be done with it, while keeping the unit names stable. While we are at it, also move the tool out of src/boot/ and into its own src/pcrextend/ dir, since it's not really doing boot related stuff anymore. 2023-09-25 11:38:01 +03:00			`ExecStart={{LIBEXECDIR}}/systemd-pcrextend --graceful --file-system=/`