SYSTEMD-PCRPHASE.SERVICE(8) systemd-pcrphase.service (NAME) systemd-pcrphase.service, systemd-pcrphase-sysinit.service, systemd- pcrphase-initrd.service, systemd-pcrmachine.service, systemd- pcrosseparator.service, systemd-pcrproduct.service, systemd- pcrlogin@.service, systemd-pcrfs-root.service, systemd-pcrfs@.service, systemd-pcrnvdone.service, systemd-pcrphase-factory-reset.service, systemd-pcrphase-storage-target-mode.service, systemd-pcrextend - UUID TPM PCR NvPCR (SYNOPSIS) systemd-pcrphase.service systemd-pcrphase-sysinit.service systemd-pcrphase-initrd.service systemd-pcrmachine.service systemd-pcrosseparator.service systemd-pcrproduct.service systemd-pcrlogin@.service systemd-pcrfs-root.service systemd-pcrfs@.service systemd-pcrnvdone.service systemd-pcrphase-factory-reset.service systemd-pcrphase-storage-target-mode.service /usr/lib/systemd/systemd-pcrextend [STRING] (DESCRIPTION) systemd-pcrphase.service systemd-pcrphase-sysinit.service systemd-pcrphase-initrd.service TPM2 PCR 11 . systemd-pcrmachine.service ( machine-id(5) ) PCR 15 . systemd-pcrosseparator.service "os-separator" PCR 0-7 9 12-14 . ( + ) PCR << >> (seal) . systemd-pcrproduct.service UUID ( SMBIOS Devicetree ) NvPCR "hardware" . systemd-pcrlogin@.service (template) ( JSON ) ( UID) NvPCR "login" . systemd- logind.service(8) user-runtime-dir@.service(5). : Type=oneshot RemainAfterExit=yes system.slice ( NvPCR NvPCR ). NvPCR "login" ( /run/log/systemd/tpm2-measure.log) TPM (append-only) . systemd-pcrnvdone.service NvPCR PCR 9 . systemd-pcrfs-root.service systemd-pcrfs@.service ( UUID UUID) PCR 15 . systemd-pcrfs-root.service systemd-pcrfs@.service . systemd-stub(7) (UKI) . stub . stub PCR 11 (userspace) TPM2 PCR 11 . PCR 11 : 1. "enter-initrd" -- initrd initrd. initrd ( UKI) . ( systemd-pcrphase- initrd.service(8) .) 2. "leave-initrd" -- initrd . initrd . ( systemd-pcrphase-sysinit.service(8) .) 3. "sysinit" -- ( ) . ( systemd-pcrphase- sysinit.service(8) .) 4. "ready" -- ( remote-fs.target) ( systemd-user-sessions.service). . ( systemd-pcrphase-sysinit.service(8) .) 5. "shutdown" -- . . ( systemd-pcrphase.service .) 6. "final" -- . ( ) . ( systemd-pcrphase-sysinit.service(8) .) PCR 11 "enter-initrd" "leave-initrd" "sysinit" "ready" "shutdown" "final" . ( << >> "phase path") . "enter-initrd:leave-initrd:sysinit:ready" initrd "enter-initrd" . initrd (":") . . TPM2 initrd . systemd-measure(1) PCR 11 ( --phase=) . systemd-pcrfs-root.service systemd-pcrfs@.service systemd-gpt-auto- generator(8) /var/ . systemd-fstab- generator(8) x-systemd.pcrfs /etc/fstab . (OPTIONS) /usr/lib/systemd/systemd-pcrextend PCR NvPCR : --bank= PCR . PCR . . --pcr= (index) PCR . --machine-id --file-system= 15 ( --product-id ) 11 . PCR . --nvpcr= . . --nvpcr= NvPCR . NvPCR PCR TPM NV . "hardware" "disk-encryption" . --product-id "hardware" . --pcr= . . --tpm2-device=PATH TPM2 . TPM2 ( /dev/tpmrm0). "auto" TPM2 ( ) . "list" TPM2 . . --graceful TPM2 0 ( ). TPM2 . . --early (early-boot) . (anchor secret) NvPCR /var/lib/ /run/ . ( initrd .) . --machine-id PCR 11 PCR 15 . . --product-id PCR 11 UUID NvPCR "hardware" . . --login= PCR 11 NvPCR "login" . UID . "regular" "perMachine" "binding" ( NvPCR ) JSON . systemd-pcrlogin@.service . . --file-system= PCR 11 PCR 15 . . . --event-type= (event log) . "help" . --machine-id --product-id --file-system= --login= "phase" . . -h, --help . --version . (FILES) /run/log/systemd/tpm2-measure.log /run/log/systemd/tpm2-measure.log JSON-SEQ[1] TCG (CEL-JSON)[2] ( "recnum" ). BSD LOCK_EX (flock(2)) . (quote) TPM (snapshot) LOCK_SH . . /usr/lib/nvpcr/*.nvpcr NvPCR. . (SEE ALSO) systemd(1), systemd-stub(7), systemd-measure(1), systemd-gpt-auto- generator(8), systemd-fstab-generator(8), TPM2 PCR systemd[3] (NOTES) 1. JSON-SEQ https://www.rfc-editor.org/rfc/rfc7464.html 2. TCG (CEL-JSON) https://trustedcomputinggroup.org/resource/canonical-event-log- format 3. TPM2 PCR systemd https://systemd.io/TPM2_PCR_MEASUREMENTS systemd 261.2 SYSTEMD-PCRPHASE.SERVICE(8)