From dd45f3ad88b544f065f27143801306a7d6dffd02 Mon Sep 17 00:00:00 2001 From: sommerfeld Date: Thu, 17 Sep 2026 15:05:36 +0100 Subject: Maintain the approved PCR 7 unlock policy --- .../system/systemd-pcrlock-make-policy.service.d/pcr7.conf | 9 +++++++++ 1 file changed, 9 insertions(+) create mode 100644 etc/systemd/system/systemd-pcrlock-make-policy.service.d/pcr7.conf (limited to 'etc/systemd') diff --git a/etc/systemd/system/systemd-pcrlock-make-policy.service.d/pcr7.conf b/etc/systemd/system/systemd-pcrlock-make-policy.service.d/pcr7.conf new file mode 100644 index 0000000..01a51a5 --- /dev/null +++ b/etc/systemd/system/systemd-pcrlock-make-policy.service.d/pcr7.conf @@ -0,0 +1,9 @@ +[Unit] +ConditionPathExists=/var/lib/systemd/pcrlock.json +ConditionPathExistsGlob=/var/lib/pcrlock.d/*-secureboot-policy.pcrlock.d/generated.pcrlock +ConditionPathExistsGlob=/var/lib/pcrlock.d/*-secureboot-authority.pcrlock.d/generated.pcrlock +RequiresMountsFor=/boot /var/lib/systemd /var/lib/pcrlock.d + +[Service] +ExecStart= +ExecStart=/usr/lib/systemd/systemd-pcrlock make-policy --pcr=7 --location=770 -- cgit v1.3.1