Lennart Poettering 2e64cb71b9 tpm2-setup: add new early boot tool for initializing the SRK ... This adds an explicit service for initializing the TPM2 SRK. This is implicitly also done by systemd-cryptsetup, hence strictly speaking redundant, but doing this early has the benefit that we can parallelize this in a nicer way. This also write a copy of the SRK public key in PEM format to /run/ + /var/lib/, thus pinning the disk image to the TPM. Making the SRK public key is also useful for allowing easy offline encryption for a specific TPM. Sooner or later we should probably grow what this service does, the above is just the first step. For example, the service should probably offer the ability to reset the TPM (clear the owner hierarchy?) on a factory reset, if such a policy is needed. And we might want to install some default AK (?). Fixes: #27986 Also see: #22637		2023-09-29 19:36:04 +02:00
..
meson.build	tpm2-setup: add new early boot tool for initializing the SRK	2023-09-29 19:36:04 +02:00