units: add a tpm2.target synchronization point and small generator that pulls in

[thirdparty/systemd.git] / units / systemd-pcrphase.service.in

diff --git a/units/systemd-pcrphase.service.in b/units/systemd-pcrphase.service.in
index ce469befa84528d7e45ca0133ca3d0837cef4b4a..26b9e5c5389114cb26f1cadb20a448d90d1459c0 100644 (file)
--- a/units/systemd-pcrphase.service.in
+++ b/units/systemd-pcrphase.service.in
@@ -10,14 +10,13 @@
 [Unit]
 Description=TPM2 PCR Barrier (User)
 Documentation=man:systemd-pcrphase.service(8)
-After=remote-fs.target remote-cryptsetup.target
+After=remote-fs.target remote-cryptsetup.target tpm2.target
 Before=systemd-user-sessions.service
-AssertPathExists=!/etc/initrd-release
-ConditionSecurity=tpm2
-ConditionPathExists=/sys/firmware/efi/efivars/StubPcrKernelImage-4a67b082-0a4c-41cf-b6c7-440b29bb8c4f
+ConditionPathExists=!/etc/initrd-release
+ConditionSecurity=measured-uki
 
 [Service]
 Type=oneshot
 RemainAfterExit=yes
-ExecStart={{ROOTLIBEXECDIR}}/systemd-pcrphase ready
-ExecStop={{ROOTLIBEXECDIR}}/systemd-pcrphase shutdown
+ExecStart={{LIBEXECDIR}}/systemd-pcrextend --graceful ready
+ExecStop={{LIBEXECDIR}}/systemd-pcrextend --graceful shutdown