units/systemd-pcrphase-storage-target-mode.service.in

#  SPDX-License-Identifier: LGPL-2.1-or-later
#
#  This file is part of systemd.
#
#  systemd is free software; you can redistribute it and/or modify it
#  under the terms of the GNU Lesser General Public License as published by
#  the Free Software Foundation; either version 2.1 of the License, or
#  (at your option) any later version.

[Unit]
Description=TPM PCR Barrier (Storage Target Mode)
Documentation=man:systemd-pcrphase-storage-target-mode.service(8)
DefaultDependencies=no
Conflicts=shutdown.target
After=tpm2.target
Before=shutdown.target
ConditionPathExists=/etc/initrd-release
ConditionSecurity=measured-uki
FailureAction=reboot-force

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart={{LIBEXECDIR}}/systemd-pcrextend --graceful storage-target-mode-start
ExecStop={{LIBEXECDIR}}/systemd-pcrextend --graceful storage-target-mode-stop
units: measure the fact we enter storage target mode into TPM storagetm mode means we we are network accessible. let's lock down access to TPM secrets in this case: let's measure a pcr "phase" string into PCR 11. This is good as it means that if we are exploited in this state FDE secrets protected by TPM are likely to remain protected, since the PCR values wouldn't allow access. 2025-02-27 12:33:36 +01:00			`# SPDX-License-Identifier: LGPL-2.1-or-later`
			`#`
			`# This file is part of systemd.`
			`#`
			`# systemd is free software; you can redistribute it and/or modify it`
			`# under the terms of the GNU Lesser General Public License as published by`
			`# the Free Software Foundation; either version 2.1 of the License, or`
			`# (at your option) any later version.`

			`[Unit]`
			`Description=TPM PCR Barrier (Storage Target Mode)`
			`Documentation=man:systemd-pcrphase-storage-target-mode.service(8)`
			`DefaultDependencies=no`
			`Conflicts=shutdown.target`
			`After=tpm2.target`
			`Before=shutdown.target`
			`ConditionPathExists=/etc/initrd-release`
			`ConditionSecurity=measured-uki`
pcrextend: whenever we fail to extend PCRs, reboot immediately PCR extensions are supposed to be useful for "destroying" the ability to access TPM bound secrets. Hence, if for some reason we fail to extend a PCR, it's safer to just reboot, instead of going on without the extension, leaving secrets potentially accessible which should not be accessible. Note that the services exit gracefully if no TPM is found, hence this should not be triggered on TPM-less systems. However, this enforces that if there is a TPM that is accessible to Linux and that works properly, the PCR measurement must complete too. Inspired by this thread: https://lists.freedesktop.org/archives/systemd-devel/2025-March/051244.html 2025-03-11 17:28:47 +01:00			`FailureAction=reboot-force`
units: measure the fact we enter storage target mode into TPM storagetm mode means we we are network accessible. let's lock down access to TPM secrets in this case: let's measure a pcr "phase" string into PCR 11. This is good as it means that if we are exploited in this state FDE secrets protected by TPM are likely to remain protected, since the PCR values wouldn't allow access. 2025-02-27 12:33:36 +01:00
			`[Service]`
			`Type=oneshot`
			`RemainAfterExit=yes`
			`ExecStart={{LIBEXECDIR}}/systemd-pcrextend --graceful storage-target-mode-start`
			`ExecStop={{LIBEXECDIR}}/systemd-pcrextend --graceful storage-target-mode-stop`