SYSTEMD-PCRLOCK(8) systemd-pcrlock SYSTEMD-PCRLOCK(8) (NAME) systemd-pcrlock, systemd-pcrlock-file-system.service, systemd-pcrlock- firmware-code.service, systemd-pcrlock-firmware-config.service, systemd-pcrlock-machine-id.service, systemd-pcrlock-make- policy.service, systemd-pcrlock-secureboot-authority.service, systemd- pcrlock-secureboot-policy.service - PCR TPM2 (SYNOPSIS) /usr/lib/systemd/systemd-pcrlock [OPTIONS...] (DESCRIPTION) : . systemd . systemd-pcrlock PCR TPM2 TPM2 TPM2 NV ( TPM2) . TPM2 ( ) . systemd-pcrlock : o TPM2 UEFI ( /sys/kernel/security/tpm0/binary_bios_measurements) . o TPM2 ( /run/log/systemd/tpm2-measure.log) . o PCR TPM2. o (*.pcrlock *.pcrlock.d/*.pcrlock systemd.pcrlock(5) ) . ( .) PCR . . PCR ( ) PCR . TPM2 ( PolicyPCR PolicyOR TPM2) NV TPM2 . ( ) ( PolicyAuthorizeNV TPM2) . systemd- cryptenroll(1) systemd-repart(8) TPM2 systemd-pcrlock . --tpm2-pcrlock= . TPM2 "PolicyAuthorizeNV" 1.38 TPM 2.0 . (COMMANDS) : log TPM2 PCR . JSON --json= . 255. cel TPM2 TCG Canonical Event Log Format (CEL-JSON)[1] (STDOUT) . 255. list-components *.pcrlock /var/lib/pcrlock.d/ /usr/lib/pcrlock.d/ . systemd.pcrlock(5) . 255. predict PCR . TPM2 PCR . PCR . . 255. make-policy PCR predict . TPM2 TPM2 NV . TPM2 NV /var/lib/systemd/pcrlock.json . NV . NV (PIN) ( ). ( NV ) JSON . --recovery-pin= . . . ( --force .) /var/lib/systemd/pcrlock.json (credential) ( systemd-creds(1) ) EFI XBOOTLDR /loader/credentials/ . systemd-stub(7) initrd ( /var/ ). (boot entry token) ( bootctl(1) ) --entry-token= . 255. remove-policy . /var/lib/systemd/pcrlock.json NV . 255. is-supported TPM2 systemd-pcrlock . systemd-analyze has-tpm2 TPM2 systemd-pcrlock . "no" "partial" ( TPM2 ) "obsolete" ( TPM2 systemd-pcrlock ) "yes" . . --quiet . TPM2 PolicyAuthorizeNV SHA-256 . 258. lock-firmware-code unlock-firmware-code .pcrlock TPM2 PCR 0 ("platform-code") 2 ("external-code") . . pcrlock . . . unlock-firmware-code make-policy . systemd-pcrlock lock-firmware-code systemd-pcrlock-firmware-code.service . systemd-pcrlock ( ) . PCR TPM2 . /var/lib/pcrlock.d/250-firmware-code-early.pcrlock.d/generated.pcrlock /var/lib/pcrlock.d/550-firmware-code-late.pcrlock.d/generated.pcrlock . 255. lock-firmware-config unlock-firmware-config lock-firmware-code/unlock-firmware-code PCR 1 ("platform-config") 3 ("external-config"). TPM2 . ( SMBIOS) PCR . . unlock-firmware-config . systemd-pcrlock-firmware-config.service pcrlock . /var/lib/pcrlock.d/250-firmware-config-early.pcrlock.d/generated.pcrlock /var/lib/pcrlock.d/550-firmware-config-late.pcrlock.d/generated.pcrlock . 255. lock-secureboot-policy unlock-secureboot-policy .pcrlock SecureBoot . EFI SecureBoot PK KEK db dbx dbt dbr PCR 7 ("secure-boot-policy") . SecureBoot unlock-firmware-config . systemd-pcrlock-secureboot-policy.service pcrlock . /var/lib/pcrlock.d/230-secureboot-policy.pcrlock.d/generated.pcrlock . 255. lock-secureboot-authority unlock-secureboot-authority .pcrlock SecureBoot . SecureBoot SecureBoot UEFI PE . PCR 7 ("secure-boot-policy") . /var/lib/pcrlock.d/620-secureboot-authority.pcrlock.d/generated.pcrlock . 255. lock-gpt [DEVICE] unlock-gpt .pcrlock GPT . . PCR 5 ("boot-loader-config") . /var/lib/pcrlock.d/600-gpt.pcrlock.d/generated.pcrlock . 255. lock-pe [BINARY] unlock-pe .pcrlock PE . PCR 4 ("boot-loader-code") UEFI . . PE (UKI) lock-uki ( ) . PE . (STDIN) . pcrlock --pcrlock= . 255. lock-uki [UKI] unlock-uki .pcrlock UKI PE . PCR 4 ("boot-loader-code") systemd-stub(7) PCR 11 ("kernel-boot") UKI . lock-pe . UKI PE . (STDIN) . pcrlock --pcrlock= . 255. lock-machine-id unlock-machine-id .pcrlock /etc/machine-id . systemd- pcrmachine.service(8) PCR 15 ("system-identity") . /var/lib/pcrlock.d/820-machine-id.pcrlock . 255. lock-file-system [PATH] unlock-file-system [PATH] .pcrlock . systemd- pcrfs@.service(8) PCR 15 ("system-identity") /var/ . /var/lib/pcrlock.d/830-root-file-system.pcrlock /var/lib/pcrlock.d/840-file-system-path.pcrlock . 255. lock-kernel-cmdline [FILE] unlock-kernel-cmdline .pcrlock /proc/cmdline ( ) . PCR 9 ("kernel-initrd") . /var/lib/pcrlock.d/710-kernel-cmdline.pcrlock/generated.pcrlock . 255. lock-kernel-initrd FILE unlock-kernel-initrd .pcrlock cpio initrd . PCR 9 ("kernel-initrd") . UKI systemd-stub(7) initrd . /var/lib/pcrlock.d/720-kernel-initrd.pcrlock/generated.pcrlock . 255. lock-raw [FILE] unlock-raw .pcrlock . (STDIN - ) . --pcrs= . .pcrlock --pcrlock= (STDOUT - ) . 255. (OPTIONS) : --raw-description TPM2 . (payload) (escaped) . 255. --pcr= PCR . PCR . lock-raw lock-pe PCR . predict make-policy PCR . PCR 0-5 7 11 13-15 . PCR PCR / ( ). 255. --nv-index= NV . make-policy . NV . 255. --components= *.pcrlock *.pcrlock.d/*.pcrlock . . /etc/pcrlock.d/ /run/pcrlock.d/ /var/lib/pcrlock.d/ /usr/local/lib/pcrlock.d/ /usr/lib/pcrlock.d/ . 255. --location= . PCR / . systemd-pcrlock . . ( ). . . log predict make-policy . / . . . list-components . "760-:940-" initrd ( "760-" 750-enter-initrd.pcrlock ) ( ) ( "940-" 950-shutdown.pcrlock ). systemd.pcrlock(5) . 255. --recovery-pin= "hide" "show" "query" . "hide" . make-policy . "query" (PIN) TPM2 NV . NV . NV . "hide" "show" -- "show" -- . . NV . 255. --pcrlock= . pcrlock . lock-* . . 255. --policy= . pcrlock . /var/lib/systemd/pcrlock.json . 255. --force make-policy NV . 255. --entry-token= (boot entry token) pcrlock EFI XBOOTLDR . bootctl(1) . make-policy . 256. --quiet is-supported . 258. --json=MODE JSON . "short" ( ) "pretty" ( ) "off" ( JSON ) . --no-pager (pager) . -h, --help . --version . (EXIT STATUS) 0 . (SEE ALSO) systemd(1), systemd.pcrlock(5), systemd-cryptenroll(1), systemd- cryptsetup@.service(8), systemd-repart(8), systemd- pcrmachine.service(8), systemd-creds(1), systemd-stub(7), bootctl(1) (NOTES) 1. TCG Canonical Event Log Format (CEL-JSON) https://trustedcomputinggroup.org/resource/canonical-event-log- format systemd 261.2 SYSTEMD-PCRLOCK(8)