diff options
| author | sommerfeld <sommerfeld@sommerfeld.dev> | 2026-09-30 08:54:59 +0100 |
|---|---|---|
| committer | sommerfeld <sommerfeld@sommerfeld.dev> | 2026-09-30 08:54:59 +0100 |
| commit | c1f7133be790a972400ba63ca40f92ed699d216e (patch) | |
| tree | 12e36f95ff1e87998c1028a6e2c3242cad32aa3a /etc/kernel | |
| parent | 76db86a22a23ccfed07d6160cfdab4ef60067ef0 (diff) | |
| download | dotfiles-c1f7133be790a972400ba63ca40f92ed699d216e.tar.gz dotfiles-c1f7133be790a972400ba63ca40f92ed699d216e.tar.bz2 dotfiles-c1f7133be790a972400ba63ca40f92ed699d216e.zip | |
Enable signed initrd and NvPCR measurements
Diffstat (limited to 'etc/kernel')
| -rw-r--r-- | etc/kernel/cmdline-linux-hardened.tmpl | 2 | ||||
| -rw-r--r-- | etc/kernel/cmdline.tmpl | 2 | ||||
| -rw-r--r-- | etc/kernel/uki.conf | 9 |
3 files changed, 11 insertions, 2 deletions
diff --git a/etc/kernel/cmdline-linux-hardened.tmpl b/etc/kernel/cmdline-linux-hardened.tmpl index 674904f..a0c3b3f 100644 --- a/etc/kernel/cmdline-linux-hardened.tmpl +++ b/etc/kernel/cmdline-linux-hardened.tmpl @@ -1 +1 @@ -rd.luks.name={{ output "lsblk" "-dno" "UUID" (printf "/dev/%s" .luksRootPartition) | trim }}=root root=/dev/mapper/root rw quiet mem_sleep_default=s2idle apparmor=1 lsm=landlock,lockdown,yama,integrity,apparmor,bpf +rd.luks.name={{ output "lsblk" "-dno" "UUID" (printf "/dev/%s" .luksRootPartition) | trim }}=root rd.luks.options={{ output "lsblk" "-dno" "UUID" (printf "/dev/%s" .luksRootPartition) | trim }}=tpm2-device=auto,tpm2-measure-pcr=15,tpm2-measure-keyslot-nvpcr=cryptsetup root=/dev/mapper/root rw quiet mem_sleep_default=s2idle apparmor=1 lsm=landlock,lockdown,yama,integrity,apparmor,bpf diff --git a/etc/kernel/cmdline.tmpl b/etc/kernel/cmdline.tmpl index 555083a..860cdb0 100644 --- a/etc/kernel/cmdline.tmpl +++ b/etc/kernel/cmdline.tmpl @@ -1 +1 @@ -rd.luks.name={{ output "lsblk" "-dno" "UUID" (printf "/dev/%s" .luksRootPartition) | trim }}=root root=/dev/mapper/root rw quiet apparmor=1 lsm=landlock,lockdown,yama,integrity,apparmor,bpf +rd.luks.name={{ output "lsblk" "-dno" "UUID" (printf "/dev/%s" .luksRootPartition) | trim }}=root rd.luks.options={{ output "lsblk" "-dno" "UUID" (printf "/dev/%s" .luksRootPartition) | trim }}=tpm2-device=auto,tpm2-measure-pcr=15,tpm2-measure-keyslot-nvpcr=cryptsetup root=/dev/mapper/root rw quiet apparmor=1 lsm=landlock,lockdown,yama,integrity,apparmor,bpf diff --git a/etc/kernel/uki.conf b/etc/kernel/uki.conf new file mode 100644 index 0000000..82b7801 --- /dev/null +++ b/etc/kernel/uki.conf @@ -0,0 +1,9 @@ +[UKI] +PCRPKey=/etc/systemd/tpm2-pcr-public-key.pem +PCRBanks=sha256 + +[PCRSignature:initrd] +PCRPrivateKey=/etc/systemd/tpm2-pcr-private-key.pem +PCRPublicKey=/etc/systemd/tpm2-pcr-public-key.pem +Phases=enter-initrd +PolicyRef=initrd |