systemd and TPM2
summary
systemd now unlocks LUKS volumes by embedding TPM2 metadata in the LUKS superblock and supports PCR 11 for boot-phase/kernel measurements, PCR 15 for machine identity (file-system UUIDs and root-volume keys), signature and PIN-based PCR policies, automatic enrollment with systemd-cryptenroll, and a systemd-stub UEFI path plus a ukify tool to build signed UKIs. systemd also offers TPM-locked systemd credentials for services, PCR prediction/signing for pre-authorized unlocks, and notes remaining gaps around shim trust, kexec handling and cross-machine asymmetric enrollment.
AI-written summary · about
chapters (18)
- 0:00Start
- 0:11Goals
- 2:13Current state
- 4:53System epcr
- 6:55System PCR
- 9:24System DOS
- 10:46Summary
- 12:57UKIFY
- 14:23Systemd credentials
- 15:18Systemd creds
- 17:48Systemd part
- 18:52Nondestructive
- 21:25Weaknesses
- 24:03Symmetric asymmetric unlocking
- 25:59No signature scheme
- 31:47QA
- 35:03Systemd
- 36:43Linux
