diff options
| author | sommerfeld <sommerfeld@sommerfeld.dev> | 2026-09-30 08:54:59 +0100 |
|---|---|---|
| committer | sommerfeld <sommerfeld@sommerfeld.dev> | 2026-09-30 08:54:59 +0100 |
| commit | 67b03911aa43bac7c324c01bdb2bb6a31121acb5 (patch) | |
| tree | 963172fb28eabe9f157a1f63c14aeb1ea52b27ab /etc/systemd | |
| parent | 698e170d0f329119c84d2347bdcaaa1159b910de (diff) | |
| download | dotfiles-67b03911aa43bac7c324c01bdb2bb6a31121acb5.tar.gz dotfiles-67b03911aa43bac7c324c01bdb2bb6a31121acb5.tar.bz2 dotfiles-67b03911aa43bac7c324c01bdb2bb6a31121acb5.zip | |
Bind TPM pcrlock policy to GPT measurements
Diffstat (limited to 'etc/systemd')
| -rw-r--r-- | etc/systemd/system/systemd-pcrlock-make-policy.service.d/pcr7.conf | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/etc/systemd/system/systemd-pcrlock-make-policy.service.d/pcr7.conf b/etc/systemd/system/systemd-pcrlock-make-policy.service.d/pcr7.conf index 01a51a5..0bc00f2 100644 --- a/etc/systemd/system/systemd-pcrlock-make-policy.service.d/pcr7.conf +++ b/etc/systemd/system/systemd-pcrlock-make-policy.service.d/pcr7.conf @@ -2,8 +2,9 @@ ConditionPathExists=/var/lib/systemd/pcrlock.json ConditionPathExistsGlob=/var/lib/pcrlock.d/*-secureboot-policy.pcrlock.d/generated.pcrlock ConditionPathExistsGlob=/var/lib/pcrlock.d/*-secureboot-authority.pcrlock.d/generated.pcrlock +ConditionPathExists=/var/lib/pcrlock.d/600-gpt.pcrlock.d/generated.pcrlock RequiresMountsFor=/boot /var/lib/systemd /var/lib/pcrlock.d [Service] ExecStart= -ExecStart=/usr/lib/systemd/systemd-pcrlock make-policy --pcr=7 --location=770 +ExecStart=/usr/lib/systemd/systemd-pcrlock make-policy --strict=yes --pcr=5 --pcr=7 --location=770 |