diff options
| author | sommerfeld <sommerfeld@sommerfeld.dev> | 2026-09-30 08:54:59 +0100 |
|---|---|---|
| committer | sommerfeld <sommerfeld@sommerfeld.dev> | 2026-09-30 08:54:59 +0100 |
| commit | e58d9074fd0cfd4677548fcf87a1836a8c7bc773 (patch) | |
| tree | 357380d2b9c068a6a9fdf0778c83ae9a59997b97 /docs/tpm-unlock.md | |
| parent | 67b03911aa43bac7c324c01bdb2bb6a31121acb5 (diff) | |
| download | dotfiles-e58d9074fd0cfd4677548fcf87a1836a8c7bc773.tar.gz dotfiles-e58d9074fd0cfd4677548fcf87a1836a8c7bc773.tar.bz2 dotfiles-e58d9074fd0cfd4677548fcf87a1836a8c7bc773.zip | |
Use Python for TPM policy index check
Diffstat (limited to 'docs/tpm-unlock.md')
| -rw-r--r-- | docs/tpm-unlock.md | 15 |
1 files changed, 11 insertions, 4 deletions
diff --git a/docs/tpm-unlock.md b/docs/tpm-unlock.md index 4d17f1e..dfe24bf 100644 --- a/docs/tpm-unlock.md +++ b/docs/tpm-unlock.md @@ -203,9 +203,16 @@ sudo /usr/lib/systemd/systemd-pcrlock --strict=yes --pcr=5 --pcr=7 \ just apply sudo /usr/lib/systemd/systemd-pcrlock make-policy \ --strict=yes --pcr=5 --pcr=7 --location=770 -sudo jq -e --slurpfile old /var/lib/dotfiles/tpm-gpt/pcr7-policy.json \ - '.nvIndex == $old[0].nvIndex and .nvHandle == $old[0].nvHandle' \ - /var/lib/systemd/pcrlock.json >/dev/null +sudo /usr/bin/python3 - <<'PY' +import json +from pathlib import Path + +old = json.loads(Path('/var/lib/dotfiles/tpm-gpt/pcr7-policy.json').read_text()) +current = json.loads(Path('/var/lib/systemd/pcrlock.json').read_text()) +if (old['nvIndex'], old['nvHandle']) != (current['nvIndex'], current['nvHandle']): + raise SystemExit('TPM NV index changed; stop') +print('verified: existing TPM NV index retained') +PY just tpm-nvpcr-check just tpm-unlock-check ``` @@ -213,7 +220,7 @@ just tpm-unlock-check The GPT command writes `/var/lib/pcrlock.d/600-gpt.pcrlock.d/generated.pcrlock`. Stop and inspect that file if it already exists. `just apply` installs the service override. -The `jq` check confirms that the existing TPM NV index is still in use. +The Python check confirms that the existing TPM NV index is still in use. The new checker requires both PCRs in the stored policy, a matching EFI boot credential, and a strict prediction. Keep the backup on encrypted root storage. The first normal reboot is the test of automatic unlock; do it only when you |