[Unit]
ConditionPathExists=/var/lib/systemd/pcrlock.json
ConditionPathExistsGlob=/var/lib/pcrlock.d/*-secureboot-policy.pcrlock.d/generated.pcrlock
ConditionPathExistsGlob=/var/lib/pcrlock.d/*-secureboot-authority.pcrlock.d/generated.pcrlock
ConditionPathExists=/var/lib/pcrlock.d/600-gpt.pcrlock.d/generated.pcrlock
RequiresMountsFor=/boot /var/lib/systemd /var/lib/pcrlock.d

[Service]
ExecStart=
ExecStart=/usr/lib/systemd/systemd-pcrlock make-policy --strict=yes --pcr=5 --pcr=7 --location=770