From 76db86a22a23ccfed07d6160cfdab4ef60067ef0 Mon Sep 17 00:00:00 2001 From: sommerfeld Date: Wed, 30 Sep 2026 08:54:59 +0100 Subject: Mask unused NvPCR measurements on the Arch host --- etc/mkinitcpio.conf.d/60-no-nvpcr.conf | 9 +++++++++ etc/nvpcr/cryptsetup.nvpcr | 0 etc/nvpcr/hardware.nvpcr | 0 etc/nvpcr/login.nvpcr | 0 etc/nvpcr/verity.nvpcr | 0 etc/systemd/system/systemd-pcrlogin@.service | 0 etc/systemd/system/systemd-pcrproduct.service | 0 7 files changed, 9 insertions(+) create mode 100644 etc/mkinitcpio.conf.d/60-no-nvpcr.conf create mode 100644 etc/nvpcr/cryptsetup.nvpcr create mode 100644 etc/nvpcr/hardware.nvpcr create mode 100644 etc/nvpcr/login.nvpcr create mode 100644 etc/nvpcr/verity.nvpcr create mode 100644 etc/systemd/system/systemd-pcrlogin@.service create mode 100644 etc/systemd/system/systemd-pcrproduct.service (limited to 'etc') diff --git a/etc/mkinitcpio.conf.d/60-no-nvpcr.conf b/etc/mkinitcpio.conf.d/60-no-nvpcr.conf new file mode 100644 index 0000000..06b94ff --- /dev/null +++ b/etc/mkinitcpio.conf.d/60-no-nvpcr.conf @@ -0,0 +1,9 @@ +# Keep the unused NvPCR definitions and consumers masked in the initramfs. +FILES+=( + /etc/nvpcr/cryptsetup.nvpcr + /etc/nvpcr/hardware.nvpcr + /etc/nvpcr/login.nvpcr + /etc/nvpcr/verity.nvpcr + /etc/systemd/system/systemd-pcrlogin@.service + /etc/systemd/system/systemd-pcrproduct.service +) diff --git a/etc/nvpcr/cryptsetup.nvpcr b/etc/nvpcr/cryptsetup.nvpcr new file mode 100644 index 0000000..e69de29 diff --git a/etc/nvpcr/hardware.nvpcr b/etc/nvpcr/hardware.nvpcr new file mode 100644 index 0000000..e69de29 diff --git a/etc/nvpcr/login.nvpcr b/etc/nvpcr/login.nvpcr new file mode 100644 index 0000000..e69de29 diff --git a/etc/nvpcr/verity.nvpcr b/etc/nvpcr/verity.nvpcr new file mode 100644 index 0000000..e69de29 diff --git a/etc/systemd/system/systemd-pcrlogin@.service b/etc/systemd/system/systemd-pcrlogin@.service new file mode 100644 index 0000000..e69de29 diff --git a/etc/systemd/system/systemd-pcrproduct.service b/etc/systemd/system/systemd-pcrproduct.service new file mode 100644 index 0000000..e69de29 -- cgit v1.3.1