From c1f7133be790a972400ba63ca40f92ed699d216e Mon Sep 17 00:00:00 2001 From: sommerfeld Date: Wed, 30 Sep 2026 08:54:59 +0100 Subject: Enable signed initrd and NvPCR measurements --- etc/initcpio/install/nvpcr | 14 ++++++++++++++ etc/kernel/cmdline-linux-hardened.tmpl | 2 +- etc/kernel/cmdline.tmpl | 2 +- etc/kernel/uki.conf | 9 +++++++++ etc/mkinitcpio.conf | 2 +- etc/mkinitcpio.conf.d/60-no-nvpcr.conf | 9 --------- etc/nvpcr/cryptsetup.nvpcr | 0 etc/nvpcr/hardware.nvpcr | 0 etc/nvpcr/login.nvpcr | 0 etc/nvpcr/verity.nvpcr | 0 etc/systemd/system/systemd-pcrlogin@.service | 0 etc/systemd/system/systemd-pcrproduct.service | 0 12 files changed, 26 insertions(+), 12 deletions(-) create mode 100644 etc/initcpio/install/nvpcr create mode 100644 etc/kernel/uki.conf delete mode 100644 etc/mkinitcpio.conf.d/60-no-nvpcr.conf delete mode 100644 etc/nvpcr/cryptsetup.nvpcr delete mode 100644 etc/nvpcr/hardware.nvpcr delete mode 100644 etc/nvpcr/login.nvpcr delete mode 100644 etc/nvpcr/verity.nvpcr delete mode 100644 etc/systemd/system/systemd-pcrlogin@.service delete mode 100644 etc/systemd/system/systemd-pcrproduct.service (limited to 'etc') diff --git a/etc/initcpio/install/nvpcr b/etc/initcpio/install/nvpcr new file mode 100644 index 0000000..2fbc4ec --- /dev/null +++ b/etc/initcpio/install/nvpcr @@ -0,0 +1,14 @@ +#!/usr/bin/env bash + +build() { + # mkinitcpio 42 does not include these systemd 262 initrd services. + map add_systemd_unit \ + systemd-tpm2-setup-early.service \ + systemd-pcrnvdone.service \ + systemd-pcrextend.socket \ + systemd-pcrextend@.service +} + +help() { + echo 'Include systemd NvPCR initialization and PCR extension services.' +} diff --git a/etc/kernel/cmdline-linux-hardened.tmpl b/etc/kernel/cmdline-linux-hardened.tmpl index 674904f..a0c3b3f 100644 --- a/etc/kernel/cmdline-linux-hardened.tmpl +++ b/etc/kernel/cmdline-linux-hardened.tmpl @@ -1 +1 @@ -rd.luks.name={{ output "lsblk" "-dno" "UUID" (printf "/dev/%s" .luksRootPartition) | trim }}=root root=/dev/mapper/root rw quiet mem_sleep_default=s2idle apparmor=1 lsm=landlock,lockdown,yama,integrity,apparmor,bpf +rd.luks.name={{ output "lsblk" "-dno" "UUID" (printf "/dev/%s" .luksRootPartition) | trim }}=root rd.luks.options={{ output "lsblk" "-dno" "UUID" (printf "/dev/%s" .luksRootPartition) | trim }}=tpm2-device=auto,tpm2-measure-pcr=15,tpm2-measure-keyslot-nvpcr=cryptsetup root=/dev/mapper/root rw quiet mem_sleep_default=s2idle apparmor=1 lsm=landlock,lockdown,yama,integrity,apparmor,bpf diff --git a/etc/kernel/cmdline.tmpl b/etc/kernel/cmdline.tmpl index 555083a..860cdb0 100644 --- a/etc/kernel/cmdline.tmpl +++ b/etc/kernel/cmdline.tmpl @@ -1 +1 @@ -rd.luks.name={{ output "lsblk" "-dno" "UUID" (printf "/dev/%s" .luksRootPartition) | trim }}=root root=/dev/mapper/root rw quiet apparmor=1 lsm=landlock,lockdown,yama,integrity,apparmor,bpf +rd.luks.name={{ output "lsblk" "-dno" "UUID" (printf "/dev/%s" .luksRootPartition) | trim }}=root rd.luks.options={{ output "lsblk" "-dno" "UUID" (printf "/dev/%s" .luksRootPartition) | trim }}=tpm2-device=auto,tpm2-measure-pcr=15,tpm2-measure-keyslot-nvpcr=cryptsetup root=/dev/mapper/root rw quiet apparmor=1 lsm=landlock,lockdown,yama,integrity,apparmor,bpf diff --git a/etc/kernel/uki.conf b/etc/kernel/uki.conf new file mode 100644 index 0000000..82b7801 --- /dev/null +++ b/etc/kernel/uki.conf @@ -0,0 +1,9 @@ +[UKI] +PCRPKey=/etc/systemd/tpm2-pcr-public-key.pem +PCRBanks=sha256 + +[PCRSignature:initrd] +PCRPrivateKey=/etc/systemd/tpm2-pcr-private-key.pem +PCRPublicKey=/etc/systemd/tpm2-pcr-public-key.pem +Phases=enter-initrd +PolicyRef=initrd diff --git a/etc/mkinitcpio.conf b/etc/mkinitcpio.conf index fab5fa1..e9aca13 100644 --- a/etc/mkinitcpio.conf +++ b/etc/mkinitcpio.conf @@ -52,7 +52,7 @@ FILES=() # ## NOTE: If you have /usr on a separate partition, you MUST include the # usr and fsck hooks. -HOOKS=(base systemd autodetect microcode modconf kms keyboard keymap sd-vconsole block sd-encrypt filesystems fsck) +HOOKS=(base systemd nvpcr autodetect microcode modconf kms keyboard keymap sd-vconsole block sd-encrypt filesystems fsck) # COMPRESSION # Use this to compress the initramfs image. By default, zstd compression diff --git a/etc/mkinitcpio.conf.d/60-no-nvpcr.conf b/etc/mkinitcpio.conf.d/60-no-nvpcr.conf deleted file mode 100644 index 06b94ff..0000000 --- a/etc/mkinitcpio.conf.d/60-no-nvpcr.conf +++ /dev/null @@ -1,9 +0,0 @@ -# Keep the unused NvPCR definitions and consumers masked in the initramfs. -FILES+=( - /etc/nvpcr/cryptsetup.nvpcr - /etc/nvpcr/hardware.nvpcr - /etc/nvpcr/login.nvpcr - /etc/nvpcr/verity.nvpcr - /etc/systemd/system/systemd-pcrlogin@.service - /etc/systemd/system/systemd-pcrproduct.service -) diff --git a/etc/nvpcr/cryptsetup.nvpcr b/etc/nvpcr/cryptsetup.nvpcr deleted file mode 100644 index e69de29..0000000 diff --git a/etc/nvpcr/hardware.nvpcr b/etc/nvpcr/hardware.nvpcr deleted file mode 100644 index e69de29..0000000 diff --git a/etc/nvpcr/login.nvpcr b/etc/nvpcr/login.nvpcr deleted file mode 100644 index e69de29..0000000 diff --git a/etc/nvpcr/verity.nvpcr b/etc/nvpcr/verity.nvpcr deleted file mode 100644 index e69de29..0000000 diff --git a/etc/systemd/system/systemd-pcrlogin@.service b/etc/systemd/system/systemd-pcrlogin@.service deleted file mode 100644 index e69de29..0000000 diff --git a/etc/systemd/system/systemd-pcrproduct.service b/etc/systemd/system/systemd-pcrproduct.service deleted file mode 100644 index e69de29..0000000 -- cgit v1.3.1