shaba/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd.git synced 2024-12-25 01:34:28 +03:00
Code
360179ea46
systemd/units/systemd-pcrphase-sysinit.service.in

26 lines
890 B
SYSTEMD
Raw Normal View History

pcrphase: add two additional phases This adds two more phases to the PCR boot phase logic: "sysinit" + "final". The "sysinit" one is placed between sysinit.target and basic.target. It's good to have a milestone in this place, since this is after all file systems/LUKS volumes are in place (which sooner or later should result in measurements of their own) and before services are started (where we should be able to rely on them to be complete). This is particularly useful to make certain secrets available for mounting secondary file systems, but making them unavailable later. This breaks API in a way (as measurements during runtime will change), but given that the pcrphase stuff wasn't realeased yet should be OK.
2022-10-14 21:53:42 +03:00
# SPDX-License-Identifier: LGPL-2.1-or-later
#
# This file is part of systemd.
#
# systemd is free software; you can redistribute it and/or modify it
# under the terms of the GNU Lesser General Public License as published by
# the Free Software Foundation; either version 2.1 of the License, or
# (at your option) any later version.
[Unit]
Description=TPM2 PCR Barrier (Initialization)
Documentation=man:systemd-pcrphase-sysinit.service(8)
DefaultDependencies=no
Conflicts=shutdown.target
After=sysinit.target
Before=basic.target shutdown.target
units: change assert to condition to skip running in initrd/os These units are also present in the initrd, so instead of an assert, just use a condition so they are skipped where they need to be skipped. Fixes https://github.com/systemd/systemd/issues/26358
2023-02-09 02:06:27 +03:00
ConditionPathExists=!/etc/initrd-release
pcrphase: add two additional phases This adds two more phases to the PCR boot phase logic: "sysinit" + "final". The "sysinit" one is placed between sysinit.target and basic.target. It's good to have a milestone in this place, since this is after all file systems/LUKS volumes are in place (which sooner or later should result in measurements of their own) and before services are started (where we should be able to rely on them to be complete). This is particularly useful to make certain secrets available for mounting secondary file systems, but making them unavailable later. This breaks API in a way (as measurements during runtime will change), but given that the pcrphase stuff wasn't realeased yet should be OK.
2022-10-14 21:53:42 +03:00
ConditionSecurity=tpm2
ConditionPathExists=/sys/firmware/efi/efivars/StubPcrKernelImage-4a67b082-0a4c-41cf-b6c7-440b29bb8c4f
[Service]
Type=oneshot
RemainAfterExit=yes
pcrphase: gracefully exit if TPM2 support is incomplete If everything points to the fact that TPM2 should work, but then the driver fails to initialize we should handle this gracefully and not cause failing services all over the place. Fixes: #25700
2022-12-15 20:07:20 +03:00
ExecStart={{ROOTLIBEXECDIR}}/systemd-pcrphase --graceful sysinit
ExecStop={{ROOTLIBEXECDIR}}/systemd-pcrphase --graceful final
Copy Permalink