From: Lennart Poettering <lennart@poettering.net>
Date: Thu, 27 Feb 2025 11:41:57 +0000 (+0100)
Subject: units: measure "factory-reset" into PCR 11 when we request factory reset
X-Git-Tag: v258-rc1~1232^2
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=refs%2Fpull%2F36543%2Fhead;p=thirdparty%2Fsystemd.git

units: measure "factory-reset" into PCR 11 when we request factory reset

Let's make sure that the moment where factory reset is requested is
visible in the TPM PCR state, so that access to secrets is terminated.

This is particulary interesting when the system is booted with
systemd.unit=factory-reset.target on the kernel command line, requesting
a factory reset on the following boot. The preparations done in
userspace should already lose access to the TPM in that case.
---

diff --git a/units/meson.build b/units/meson.build
index 7c4650511cd..bd7f5a0724c 100644
--- a/units/meson.build
+++ b/units/meson.build
@@ -532,6 +532,11 @@ units = [
           'conditions' : ['ENABLE_BOOTLOADER', 'HAVE_OPENSSL', 'HAVE_TPM2'],
           'symlinks' : ['sysinit.target.wants/'],
         },
+        {
+          'file' : 'systemd-pcrphase-factory-reset.service.in',
+          'conditions' : ['ENABLE_BOOTLOADER', 'HAVE_OPENSSL', 'HAVE_TPM2'],
+          'symlinks' : ['factory-reset.target.wants/'],
+        },
         {
           'file' : 'systemd-pcrphase-initrd.service.in',
           'conditions' : ['ENABLE_BOOTLOADER', 'HAVE_OPENSSL', 'HAVE_TPM2', 'ENABLE_INITRD'],
diff --git a/units/systemd-pcrphase-factory-reset.service.in b/units/systemd-pcrphase-factory-reset.service.in
new file mode 100644
index 00000000000..6267336b303
--- /dev/null
+++ b/units/systemd-pcrphase-factory-reset.service.in
@@ -0,0 +1,22 @@
+#  SPDX-License-Identifier: LGPL-2.1-or-later
+#
+#  This file is part of systemd.
+#
+#  systemd is free software; you can redistribute it and/or modify it
+#  under the terms of the GNU Lesser General Public License as published by
+#  the Free Software Foundation; either version 2.1 of the License, or
+#  (at your option) any later version.
+
+[Unit]
+Description=TPM PCR Barrier (Factory Reset)
+Documentation=man:systemd-pcrphase-factory-reset.service(8)
+DefaultDependencies=no
+Conflicts=shutdown.target
+After=tpm2.target
+Before=shutdown.target factory-reset.target
+ConditionSecurity=measured-uki
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+ExecStart={{LIBEXECDIR}}/systemd-pcrextend --graceful factory-reset