SYSTEMD-MEASURE(1) systemd-measure SYSTEMD-MEASURE(1) (NAME) systemd-measure - TPM2 PCR 11 (SYNOPSIS) /usr/lib/systemd/systemd-measure [OPTIONS...] (DESCRIPTION) : . systemd . systemd-measure TPM2 PCR 11 (UKI) UAPI.5[1] systemd-stub(7) . ELF initrd devicetree os-release(5) (boot splash) PEM TPM2 PCR PCR . PCR 11 systemd-stub . TPM2 ( PCR ) . UKI . ukify(1) systemd-measure UKI . (COMMANDS) : status . TPM2 PCR 11 . calculate . . calculate PCR 11 --linux= --osrel= --cmdline= --initrd= --ucode= --splash= --dtb= --uname= --sbat= --pcrpkey= --profile= --dtbauto= --hwids= . --linux= . ( --current PCR 11 .) . sign calculate TPM2 PCR 11 . / (RSA) --private-key= --public-key= . JSON PCR ( --bank= ) ( systemd-creds(1) ) LUKS ( systemd-cryptsetup@.service(8) ) . PCR 11 . TPM2 TPM2 . . policy-digest sign TPM2 PCR 11 . TPM2 (digest) . JSON PCR ( --bank= ) . --public-key= --certificate= JSON . . (OPTIONS) : --linux=PATH, --osrel=PATH, --cmdline=PATH, --initrd=PATH, --ucode=PATH, --splash=PATH, --dtb=PATH, --uname=PATH, --sbat=PATH, --pcrpkey=PATH, --profile=PATH, --dtbauto=PATH, --hwids=PATH calculate sign . PE . --linux= ELF PE . --linux= . . . --profile= --dtbauto= --hwids= . --current calculate sign PCR 11 ( ). --linux= . . --bank=DIGEST PCR PCR - calculate sign - status . . "sha1" "sha256" "sha384" "sha512" . SHA1 . . . --private-key=PATH, --public-key=PATH, --certificate=PATH RSA PEM sign . --pcrpkey= --public-key= . PE ".pcrpkey" PCR 11 . . PEM . --public-key= --private-key= . --certificate= X.509 --public-key= . . --private-key=PATH/URI, --private-key-source=TYPE[:NAME], --certificate=PATH/URI, --certificate-source=TYPE[:NAME] --public-key= sign . URI (engine) (provider) OpenSSL --private-key-source= type:name engine:pkcs11 . OpenSSL . --certificate= URI OpenSSL --certificate-source= "type:name" "provider:pkcs11" . --private-key-source= . . --tpm2-device=PATH TPM2 . TPM2 ( /dev/tpmrm0). "auto" TPM2 ( ) . "list" TPM2 . . --phase=PHASE PCR 11 . <<>> . systemd-pcrphase-initrd.service systemd-pcrphase-sysinit.service systemd-pcrphase.service(8) PCR 11 . PCR . : "enter-initrd" "enter-initrd:leave-initrd" "enter-initrd:leave-initrd:sysinit" "enter-initrd:leave-initrd:sysinit:ready" PCR initrd initrd . calculate sign . PCR . PCR systemd- pcrphase.service(8) . . --append=PATH JSON PCR ( sign) JSON PCR . JSON PCR . . . JSON ( ). : JSON . . --json=MODE JSON . "short" ( ) "pretty" ( ) "off" ( JSON ) . --no-pager (pager) . -h, --help . --version . (EXAMPLES) . TPM PCR 11 $ ukify build \ --linux=vmlinux \ --initrd=initrd.cpio \ --os-release=@os-release.txt \ --cmdline=@cmdline.txt \ --splash=splash.bmp \ --devicetree=devicetree.dtb \ --measure \ --output=vmlinux.efi 11:sha1=d775a7b4482450ac77e03ee19bda90bd792d6ec7 11:sha256=bc6170f9ce28eb051ab465cd62be8cf63985276766cf9faf527ffefb66f45651 11:sha384=1cf67dff4757e61e5...7f49ad720be02fd07263e1f93061243aec599d1ee4b4 11:sha512=8e79acd3ddbbc8282...0c3e8ec0c714821032038f525f744960bcd082d937da ukify(1) systemd-measure . systemd-measure . . / TPM PCR 11 $ openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out tpm2-pcr-private-key.pem ..+.+++++++++......+.........+......+.......+....+.....+.+...+.......... $ openssl rsa -pubout -in tpm2-pcr-private-key.pem -out tpm2-pcr-public-key.pem $ systemd-measure sign \ --linux=vmlinux \ --osrel=os-release.txt \ --cmdline=cmdline.txt \ --initrd=initrd.cpio \ --splash=splash.bmp \ --dtb=devicetree.dtb \ --pcrpkey=tpm2-pcr-public-key.pem \ --bank=sha1 \ --bank=sha256 \ --private-key=tpm2-pcr-private-key.pem \ --public-key=tpm2-pcr-public-key.pem >tpm2-pcr-signature.json $ ukify build \ --linux=vmlinux \ --initrd=initrd.cpio \ --os-release=@os-release.txt \ --cmdline=@cmdline.txt \ --splash=splash.bmp \ --devicetree=devicetree.dtb \ --pcr-private-key=tpm2-pcr-private-key.pem \ --pcr-public-key=tpm2-pcr-public-key.pem \ --pcr-banks=sha1,sha256 \ --output=vmlinuz.efi PCR LUKS (enroll) : # systemd-cryptenroll --tpm2-device=auto \ --tpm2-public-key=tpm2-pcr-public-key.pem \ --tpm2-signature=tpm2-pcr-signature.json \ /dev/sda5 : # systemd-cryptsetup attach \ volume5 /dev/sda5 - \ tpm2-device=auto,tpm2-signature=/path/to/tpm2-pcr-signature.json vmlinux.efi systemd-cryptenroll systemd-cryptsetup . . PCR initrd PCR initrd . . : initrd . $ openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out tpm2-pcr-private-key.pem .+........+.+........+.......+...+...+........+....+......+..+.......... $ openssl rsa -pubout -in tpm2-pcr-private-key.pem -out tpm2-pcr-public-key.pem $ openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out tpm2-pcr-initrd-private-key.pem ..+.......++........+........+......+........+....+.....+.+..+.......... $ openssl rsa -pubout -in tpm2-pcr-initrd-private-key.pem -out tpm2-pcr-initrd-public-key.pem $ ukify build \ --linux=vmlinux-1.2.3 \ --initrd=initrd.cpio \ --os-release=@os-release.txt \ --cmdline=@cmdline.txt \ --splash=splash.bmp \ --devicetree=devicetree.dtb \ --pcr-private-key=tpm2-pcr-private-key.pem \ --pcr-public-key=tpm2-pcr-public-key.pem \ --phases=enter-initrd,enter-initrd:leave-initrd,enter-initrd:leave-initrd:sysinit,enter-initrd:leave-initrd:sysinit:ready \ --pcr-banks=sha1,sha256 \ --pcr-private-key=tpm2-pcr-initrd-private-key.pem \ --pcr-public-key=tpm2-pcr-initrd-public-key.pem \ --phases=enter-initrd \ --uname=1.2.3 \ --output=vmlinux-1.2.3.efi + /usr/lib/systemd/systemd-measure sign --linux=vmlinux-1.2.3 \ --osrel=os-release.txt --cmdline=cmdline.txt --dtb=devicetree.dtb \ --splash=splash.bmp --initrd=initrd.cpio --bank=sha1 --bank=sha256 \ --private-key=tpm2-pcr-private-key.pem --public-key=tpm2-pcr-public-key.pem \ --phase=enter-initrd --phase=enter-initrd:leave-initrd \ --phase=enter-initrd:leave-initrd:sysinit \ --phase=enter-initrd:leave-initrd:sysinit:ready + /usr/lib/systemd/systemd-measure sign --linux=vmlinux-1.2.3 \ --osrel=os-release.txt --cmdline=cmdline.txt --dtb=devicetree.dtb \ --splash=splash.bmp --initrd=initrd.cpio --bank=sha1 --bank=sha256 \ --private-key=tpm2-pcr-initrd-private-key.pem \ --public-key=tpm2-pcr-initrd-public-key.pem \ --phase=enter-initrd Wrote unsigned vmlinux-1.2.3.efi ukify systemd-measure ( "+" ) systemd-measure . ".pcrsig" . systemd-measure --append= . PE ".pcrpkey" --pcr-private-key= . ".pcrpkey" systemd-cryptenroll systemd-creds . tpm2-pcr-initrd-public-key.pem --tpm2-public-key= . (EXIT STATUS) 0 . (SEE ALSO) systemd(1), systemd-stub(7), ukify(1), systemd-creds(1), systemd- cryptsetup@.service(8), systemd-pcrphase.service(8) (NOTES) 1. UAPI.5 Unified Kernel Image (UKI) https://uapi-group.org/specifications/specs/unified_kernel_image systemd 261.2 SYSTEMD-MEASURE(1)