From 67b03911aa43bac7c324c01bdb2bb6a31121acb5 Mon Sep 17 00:00:00 2001 From: sommerfeld Date: Wed, 30 Sep 2026 08:54:59 +0100 Subject: Bind TPM pcrlock policy to GPT measurements --- etc/systemd/system/systemd-pcrlock-make-policy.service.d/pcr7.conf | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'etc/systemd/system') diff --git a/etc/systemd/system/systemd-pcrlock-make-policy.service.d/pcr7.conf b/etc/systemd/system/systemd-pcrlock-make-policy.service.d/pcr7.conf index 01a51a5..0bc00f2 100644 --- a/etc/systemd/system/systemd-pcrlock-make-policy.service.d/pcr7.conf +++ b/etc/systemd/system/systemd-pcrlock-make-policy.service.d/pcr7.conf @@ -2,8 +2,9 @@ ConditionPathExists=/var/lib/systemd/pcrlock.json ConditionPathExistsGlob=/var/lib/pcrlock.d/*-secureboot-policy.pcrlock.d/generated.pcrlock ConditionPathExistsGlob=/var/lib/pcrlock.d/*-secureboot-authority.pcrlock.d/generated.pcrlock +ConditionPathExists=/var/lib/pcrlock.d/600-gpt.pcrlock.d/generated.pcrlock RequiresMountsFor=/boot /var/lib/systemd /var/lib/pcrlock.d [Service] ExecStart= -ExecStart=/usr/lib/systemd/systemd-pcrlock make-policy --pcr=7 --location=770 +ExecStart=/usr/lib/systemd/systemd-pcrlock make-policy --strict=yes --pcr=5 --pcr=7 --location=770 -- cgit v1.3.1