systemd/units/systemd-pcrlock-make-policy.service.in

#  SPDX-License-Identifier: LGPL-2.1-or-later
#
#  This file is part of systemd.
#
#  systemd is free software; you can redistribute it and/or modify it
#  under the terms of the GNU Lesser General Public License as published by
#  the Free Software Foundation; either version 2.1 of the License, or
#  (at your option) any later version.

[Unit]
Description=Make TPM PCR Policy
Documentation=man:systemd-pcrlock(8)
DefaultDependencies=no
Conflicts=shutdown.target
After=systemd-tpm2-setup.service
Before=sysinit.target shutdown.target
After=systemd-remount-fs.service var.mount
ConditionPathExists=!/etc/initrd-release
ConditionSecurity=measured-uki

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart={{LIBEXECDIR}}/systemd-pcrlock make-policy --location=770

[Install]
WantedBy=sysinit.target
units: add units that put together and install a TPM2 PCR policy at boot (This is disabled by default, for now) 2023-10-23 13:02:53 +03:00			`# SPDX-License-Identifier: LGPL-2.1-or-later`
			`#`
			`# This file is part of systemd.`
			`#`
			`# systemd is free software; you can redistribute it and/or modify it`
			`# under the terms of the GNU Lesser General Public License as published by`
			`# the Free Software Foundation; either version 2.1 of the License, or`
			`# (at your option) any later version.`

			`[Unit]`
units: retitle systemd-pcrextend.{service,socket}, change TPM2→TPM I was looking at the logs in some bug and saw this: Mar 13 15:55:12 fedora systemd[1]: systemd-pcrmachine.service - TPM2 PCR Machine ID Measurement was skipped because of an unmet condition check (ConditionSecurity=measured-uki). Mar 13 15:55:12 fedora systemd[1]: Starting systemd-remount-fs.service - Remount Root and Kernel File Systems... Mar 13 15:55:12 fedora systemd[1]: systemd-tpm2-setup-early.service - TPM2 SRK Setup (Early) was skipped because of an unmet condition check (ConditionSecurity=measured-uki). This is overly technical, for most units we don't provide this level of detail about the implementation. So retitle the units to be more accessible. Also, the fact that it's a v. 2 of the TPM is not that important. We don't support TPM 1.2, but computers without TPM v2 are getting rare. For other units we don't advertise the version of hardware, and let's not do this here, to reduce some complexity. 2024-03-14 00:18:13 +03:00			`Description=Make TPM PCR Policy`
units: add units that put together and install a TPM2 PCR policy at boot (This is disabled by default, for now) 2023-10-23 13:02:53 +03:00			`Documentation=man:systemd-pcrlock(8)`
			`DefaultDependencies=no`
			`Conflicts=shutdown.target`
			`After=systemd-tpm2-setup.service`
			`Before=sysinit.target shutdown.target`
units: Order pcrlock services after systemd-remounts-fs.service These write to /var and as such need to wait until after the rootfs has been remounted read-write. 2024-01-26 13:29:35 +03:00			`After=systemd-remount-fs.service var.mount`
units: add units that put together and install a TPM2 PCR policy at boot (This is disabled by default, for now) 2023-10-23 13:02:53 +03:00			`ConditionPathExists=!/etc/initrd-release`
			`ConditionSecurity=measured-uki`

			`[Service]`
			`Type=oneshot`
			`RemainAfterExit=yes`
			`ExecStart={{LIBEXECDIR}}/systemd-pcrlock make-policy --location=770`

			`[Install]`
			`WantedBy=sysinit.target`