Enable signed initrd and NvPCR measurements

12 files changed, 26 insertions, 12 deletions

diff --git a/etc/initcpio/install/nvpcr b/etc/initcpio/install/nvpcr
new file mode 100644
index 0000000..2fbc4ec
--- /dev/null
+++ b/etc/initcpio/install/nvpcr
@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+
+build() {
+    # mkinitcpio 42 does not include these systemd 262 initrd services.
+    map add_systemd_unit \
+        systemd-tpm2-setup-early.service \
+        systemd-pcrnvdone.service \
+        systemd-pcrextend.socket \
+        systemd-pcrextend@.service
+}
+
+help() {
+    echo 'Include systemd NvPCR initialization and PCR extension services.'
+}
diff --git a/etc/kernel/cmdline-linux-hardened.tmpl b/etc/kernel/cmdline-linux-hardened.tmpl
index 674904f..a0c3b3f 100644
--- a/etc/kernel/cmdline-linux-hardened.tmpl
+++ b/etc/kernel/cmdline-linux-hardened.tmpl
@@ -1 +1 @@
-rd.luks.name={{ output "lsblk" "-dno" "UUID" (printf "/dev/%s" .luksRootPartition) | trim }}=root root=/dev/mapper/root rw quiet mem_sleep_default=s2idle apparmor=1 lsm=landlock,lockdown,yama,integrity,apparmor,bpf
+rd.luks.name={{ output "lsblk" "-dno" "UUID" (printf "/dev/%s" .luksRootPartition) | trim }}=root rd.luks.options={{ output "lsblk" "-dno" "UUID" (printf "/dev/%s" .luksRootPartition) | trim }}=tpm2-device=auto,tpm2-measure-pcr=15,tpm2-measure-keyslot-nvpcr=cryptsetup root=/dev/mapper/root rw quiet mem_sleep_default=s2idle apparmor=1 lsm=landlock,lockdown,yama,integrity,apparmor,bpf
diff --git a/etc/kernel/cmdline.tmpl b/etc/kernel/cmdline.tmpl
index 555083a..860cdb0 100644
--- a/etc/kernel/cmdline.tmpl
+++ b/etc/kernel/cmdline.tmpl
@@ -1 +1 @@
-rd.luks.name={{ output "lsblk" "-dno" "UUID" (printf "/dev/%s" .luksRootPartition) | trim }}=root root=/dev/mapper/root rw quiet apparmor=1 lsm=landlock,lockdown,yama,integrity,apparmor,bpf
+rd.luks.name={{ output "lsblk" "-dno" "UUID" (printf "/dev/%s" .luksRootPartition) | trim }}=root rd.luks.options={{ output "lsblk" "-dno" "UUID" (printf "/dev/%s" .luksRootPartition) | trim }}=tpm2-device=auto,tpm2-measure-pcr=15,tpm2-measure-keyslot-nvpcr=cryptsetup root=/dev/mapper/root rw quiet apparmor=1 lsm=landlock,lockdown,yama,integrity,apparmor,bpf
diff --git a/etc/kernel/uki.conf b/etc/kernel/uki.conf
new file mode 100644
index 0000000..82b7801
--- /dev/null
+++ b/etc/kernel/uki.conf
@@ -0,0 +1,9 @@
+[UKI]
+PCRPKey=/etc/systemd/tpm2-pcr-public-key.pem
+PCRBanks=sha256
+
+[PCRSignature:initrd]
+PCRPrivateKey=/etc/systemd/tpm2-pcr-private-key.pem
+PCRPublicKey=/etc/systemd/tpm2-pcr-public-key.pem
+Phases=enter-initrd
+PolicyRef=initrd
diff --git a/etc/mkinitcpio.conf b/etc/mkinitcpio.conf
index fab5fa1..e9aca13 100644
--- a/etc/mkinitcpio.conf
+++ b/etc/mkinitcpio.conf
@@ -52,7 +52,7 @@ FILES=()
 #
 ##   NOTE: If you have /usr on a separate partition, you MUST include the
 #    usr and fsck hooks.
-HOOKS=(base systemd autodetect microcode modconf kms keyboard keymap sd-vconsole block sd-encrypt filesystems fsck)
+HOOKS=(base systemd nvpcr autodetect microcode modconf kms keyboard keymap sd-vconsole block sd-encrypt filesystems fsck)
 
 # COMPRESSION
 # Use this to compress the initramfs image. By default, zstd compression
diff --git a/etc/mkinitcpio.conf.d/60-no-nvpcr.conf b/etc/mkinitcpio.conf.d/60-no-nvpcr.conf
deleted file mode 100644
index 06b94ff..0000000
--- a/etc/mkinitcpio.conf.d/60-no-nvpcr.conf
+++ /dev/null
@@ -1,9 +0,0 @@
-# Keep the unused NvPCR definitions and consumers masked in the initramfs.
-FILES+=(
-    /etc/nvpcr/cryptsetup.nvpcr
-    /etc/nvpcr/hardware.nvpcr
-    /etc/nvpcr/login.nvpcr
-    /etc/nvpcr/verity.nvpcr
-    /etc/systemd/system/systemd-pcrlogin@.service
-    /etc/systemd/system/systemd-pcrproduct.service
-)
diff --git a/etc/nvpcr/cryptsetup.nvpcr b/etc/nvpcr/cryptsetup.nvpcr
deleted file mode 100644
index e69de29..0000000
--- a/etc/nvpcr/cryptsetup.nvpcr
+++ /dev/null
diff --git a/etc/nvpcr/hardware.nvpcr b/etc/nvpcr/hardware.nvpcr
deleted file mode 100644
index e69de29..0000000
--- a/etc/nvpcr/hardware.nvpcr
+++ /dev/null
diff --git a/etc/nvpcr/login.nvpcr b/etc/nvpcr/login.nvpcr
deleted file mode 100644
index e69de29..0000000
--- a/etc/nvpcr/login.nvpcr
+++ /dev/null
diff --git a/etc/nvpcr/verity.nvpcr b/etc/nvpcr/verity.nvpcr
deleted file mode 100644
index e69de29..0000000
--- a/etc/nvpcr/verity.nvpcr
+++ /dev/null
diff --git a/etc/systemd/system/systemd-pcrlogin@.service b/etc/systemd/system/systemd-pcrlogin@.service
deleted file mode 100644
index e69de29..0000000
--- a/etc/systemd/system/systemd-pcrlogin@.service
+++ /dev/null
diff --git a/etc/systemd/system/systemd-pcrproduct.service b/etc/systemd/system/systemd-pcrproduct.service
deleted file mode 100644
index e69de29..0000000
--- a/etc/systemd/system/systemd-pcrproduct.service
+++ /dev/null