gpt-auto-generator: enable nvpcr logic by default

Let's enable this kind of measurement by default if people buy into UKIs
and stuff, just like volume key measurement is now enabled by default.

diff --git a/man/systemd-gpt-auto-generator.xml b/man/systemd-gpt-auto-generator.xml
index 398076abc73d0d3366e265397a3e0855eb405594..e267fc952870e6a5aac914ceef45607b558e1c72 100644 (file)
--- a/man/systemd-gpt-auto-generator.xml
+++ b/man/systemd-gpt-auto-generator.xml
@@ -272,9 +272,13 @@
     <para>If the system was booted via
     <citerefentry><refentrytitle>systemd-stub</refentrytitle><manvolnum>7</manvolnum></citerefentry> and the
     stub reported to userspace that the kernel image was measured to a TPM2 PCR, then any discovered root and
-    <filename>/var/</filename> volume identifiers (and volume encryption key in case it is encrypted) will be
-    automatically measured into PCR 15 on activation, via
-    <citerefentry><refentrytitle>systemd-pcrfs@.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>.</para>
+    <filename>/var/</filename> volume identifiers (and volume encryption keys, in case they are encrypted)
+    will be automatically measured into PCR 15 on activation, via
+    <citerefentry><refentrytitle>systemd-pcrfs@.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>. Moreover,
+    information about the LUKS key slot used to unlock the volume is measured into NvPCR
+    <literal>cryptsetup</literal>. Finally, if the root or <filename>/usr/</filename> partition is protected
+    via Verity its root hash and the serial/issuer of the key used for the provided root hash signature (if
+    any) are measured into the NvPCR <literal>verity</literal>.</para>
 
     <para>Mount constraint metadata contained in the file systems is validated by pulling in
     <citerefentry><refentrytitle>systemd-validatefs@.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>

diff --git a/src/gpt-auto-generator/gpt-auto-generator.c b/src/gpt-auto-generator/gpt-auto-generator.c
index 9e20e23abfe88ef2cbb475612ead213b504aebe8..4fd92a6057f6a97e593a6ef36da382263d44ad4c 100644 (file)
--- a/src/gpt-auto-generator/gpt-auto-generator.c
+++ b/src/gpt-auto-generator/gpt-auto-generator.c
@@ -190,7 +190,8 @@ static int add_veritysetup(
                 const char *id,
                 const char *data_what,
                 const char *hash_what,
-                const char *mount_opts) {
+                const char *mount_opts,
+                MountPointFlags flags) {
 
 #if HAVE_LIBCRYPTSETUP
         int r;
@@ -233,13 +234,26 @@ static int add_veritysetup(
                 "After=%1$s %2$s\n",
                 dd, dh);
 
+        _cleanup_free_ char *options =
+                strdup("root-hash-signature=auto"); /* auto means: derive signature from udev property ID_DISSECT_PART_ROOTHASH_SIG */
+        if (!options)
+                return log_oom();
+
+        if (FLAGS_SET(flags, MOUNT_MEASURE)) {
+                r = efi_measured_uki(LOG_WARNING);
+                if (r > 0 && !strextend_with_separator(&options, ",", "tpm2-measure-nvpcr=yes"))
+                        return log_oom();
+                if (r == 0)
+                        log_debug("Will not measure root hash/signature of volume '%s', not booted via systemd-stub with measurements enabled.", id);
+        }
+
         r = generator_write_veritysetup_service_section(
                         f,
                         id,
                         data_what,
                         hash_what,
                         /* roothash= */ NULL,        /* NULL means: derive root hash from udev property ID_DISSECT_PART_ROOTHASH */
-                        "root-hash-signature=auto"); /* auto means: derive signature from udev property ID_DISSECT_PART_ROOTHASH_SIG */
+                        options);
         if (r < 0)
                 return r;
 
@@ -871,7 +885,8 @@ static int add_root_mount(void) {
                                 "root",
                                 "/dev/disk/by-designator/root-verity-data",
                                 "/dev/disk/by-designator/root-verity",
-                                arg_root_options);
+                                arg_root_options,
+                                MOUNT_MEASURE);
                 if (r < 0)
                         return r;
         }
@@ -952,7 +967,8 @@ static int add_usr_mount(void) {
                                 "usr",
                                 "/dev/disk/by-designator/usr-verity-data",
                                 "/dev/disk/by-designator/usr-verity",
-                                arg_usr_options);
+                                arg_usr_options,
+                                MOUNT_MEASURE);
                 if (r < 0)
                         return r;
         }