pcrphase: rename binary to pcrextend

The tool initially just measured the boot phase, but was subsequently
extended to measure file system and machine IDs, too. At AllSystemsGo
there were request to add more, and make the tool generically
accessible.

Hence, let's rename the binary (but not the pcrphase services), to make
clear the tool is not just measureing the boot phase, but a lot of other
things too.

The tool is located in /usr/lib/ and still relatively new, hence let's
just rename the binary and be done with it, while keeping the unit names
stable.

While we are at it, also move the tool out of src/boot/ and into its own
src/pcrextend/ dir, since it's not really doing boot related stuff
anymore.

diff --git a/TODO b/TODO
index e1c031addccef605c43c7fc8ddb82c17dab40ede..4d25289339b2f90dbe5d2db100f243bbfa463fec 100644 (file)
--- a/TODO
+++ b/TODO
@@ -144,7 +144,7 @@ Features:
 * automatically mount one virtiofs during early boot phase to /run/host/,
   similar to how we do that for nspawn, based on some clear tag.
 
-* make systemd-pcrphase accessible via varlink so that clients can measure
+* make systemd-pcrextend accessible via varlink so that clients can measure
   things reasonably freely, and get a proper entry in the TPM event log we
   maintain, correctly synchronized
 

diff --git a/docs/ENVIRONMENT.md b/docs/ENVIRONMENT.md
index bbbef251594f460023bcf36a261d5f49d9bc60de..7517d15fdabe208dfe763d7fc01fd027366b1380 100644 (file)
--- a/docs/ENVIRONMENT.md
+++ b/docs/ENVIRONMENT.md
@@ -536,7 +536,7 @@ SYSTEMD_HOME_DEBUG_SUFFIX=foo \
 * `$SYSTEMD_CATALOG_SOURCES` – path to the catalog database input source
   directory to use for `journalctl --update-catalog`.
 
-`systemd-pcrphase`, `systemd-cryptsetup`:
+`systemd-pcrextend`, `systemd-cryptsetup`:
 
 * `$SYSTEMD_FORCE_MEASURE=1` — If set, force measuring of resources (which are
   marked for measurement) even if not booted on a kernel equipped with

diff --git a/man/rules/meson.build b/man/rules/meson.build
index 2884cc32b41a0911b24e0af0a1c91886a669ff3e..5f840f5afdfed76cdcea8a04e6733f1aadedeea8 100644 (file)
--- a/man/rules/meson.build
+++ b/man/rules/meson.build
@@ -1005,10 +1005,10 @@ manpages = [
  ['systemd-path', '1', [], ''],
  ['systemd-pcrphase.service',
   '8',
-  ['systemd-pcrfs-root.service',
+  ['systemd-pcrextend',
+   'systemd-pcrfs-root.service',
    'systemd-pcrfs@.service',
    'systemd-pcrmachine.service',
-   'systemd-pcrphase',
    'systemd-pcrphase-initrd.service',
    'systemd-pcrphase-sysinit.service'],
   'ENABLE_BOOTLOADER'],

diff --git a/man/systemd-measure.xml b/man/systemd-measure.xml
index 3568fb54350fc09825f628cf9ac09644fb7349ea..55ec696d8c58ff76c6d736cb67837b66db8ab4bc 100644 (file)
--- a/man/systemd-measure.xml
+++ b/man/systemd-measure.xml
@@ -191,7 +191,8 @@
         <listitem><para>Controls which boot phases to calculate expected PCR 11 values for. This takes a
         series of colon-separated strings that encode boot "paths" for entering a specific phase of the boot
         process. Each of the specified strings is measured by the
-        <filename>systemd-pcrphase-initrd.service</filename> and
+        <filename>systemd-pcrphase-initrd.service</filename>,
+        <filename>systemd-pcrphase-sysinit.service</filename>, and
         <citerefentry><refentrytitle>systemd-pcrphase.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>
         into PCR 11 during different milestones of the boot process. This switch may be specified multiple
         times to calculate PCR values for multiple boot phases at once. If not used defaults to

diff --git a/man/systemd-pcrphase.service.xml b/man/systemd-pcrphase.service.xml
index f6e7bba9d1ff4831b209323ef7199759103b2794..93d27019cb9e7b791862398ff6f8be3d203430cc 100644 (file)
--- a/man/systemd-pcrphase.service.xml
+++ b/man/systemd-pcrphase.service.xml
@@ -23,7 +23,7 @@
     <refname>systemd-pcrmachine.service</refname>
     <refname>systemd-pcrfs-root.service</refname>
     <refname>systemd-pcrfs@.service</refname>
-    <refname>systemd-pcrphase</refname>
+    <refname>systemd-pcrextend</refname>
     <refpurpose>Measure boot phase into TPM2 PCR 11, machine ID and file system identity into PCR 15</refpurpose>
   </refnamediv>
 
@@ -34,7 +34,7 @@
     <para><filename>systemd-pcrmachine.service</filename></para>
     <para><filename>systemd-pcrfs-root.service</filename></para>
     <para><filename>systemd-pcrfs@.service</filename></para>
-    <para><filename>/usr/lib/systemd/systemd-pcrphase</filename> <optional><replaceable>STRING</replaceable></optional></para>
+    <para><filename>/usr/lib/systemd/systemd-pcrextend</filename> <optional><replaceable>STRING</replaceable></optional></para>
   </refsynopsisdiv>
 
   <refsect1>
@@ -134,7 +134,7 @@
   <refsect1>
     <title>Options</title>
 
-    <para>The <filename>/usr/lib/systemd/system-pcrphase</filename> executable may also be invoked from the
+    <para>The <filename>/usr/lib/systemd/system-pcrextend</filename> executable may also be invoked from the
     command line, where it expects the word to extend into PCR 11, as well as the following switches:</para>
 
     <variablelist>

diff --git a/meson.build b/meson.build
index bf25bcba43ed6fbe5a7d8ee538b08b9053d53530..381e2a8c4e1f6089ea84d6536153e7d57506df65 100644 (file)
--- a/meson.build
+++ b/meson.build
@@ -2158,6 +2158,7 @@ subdir('src/nss-systemd')
 subdir('src/oom')
 subdir('src/partition')
 subdir('src/path')
+subdir('src/pcrextend')
 subdir('src/portable')
 subdir('src/pstore')
 subdir('src/quotacheck')

diff --git a/src/boot/meson.build b/src/boot/meson.build
index fdccb2a428abb36826a44ffa087be13ab485420b..43ff3a5982843e69d4f0701d184fdfdc593b679a 100644 (file)
--- a/src/boot/meson.build
+++ b/src/boot/meson.build
@@ -64,21 +64,6 @@ executables += [
                 'sources' : files('measure.c'),
                 'dependencies' : libopenssl,
         },
-        libexec_template + {
-                'name' : 'systemd-pcrphase',
-                'conditions' : [
-                        'HAVE_BLKID',
-                        'ENABLE_BOOTLOADER',
-                        'HAVE_OPENSSL',
-                        'HAVE_TPM2',
-                ],
-                'sources' : files('pcrphase.c'),
-                'dependencies' : [
-                        libblkid,
-                        libopenssl,
-                        tpm2,
-                ],
-        },
         libexec_template + {
                 'name' : 'systemd-boot-check-no-failures',
                 'sources' : files('boot-check-no-failures.c'),

diff --git a/src/pcrextend/meson.build b/src/pcrextend/meson.build
new file mode 100644 (file)
index 0000000..05c5350
--- /dev/null
+++ b/src/pcrextend/meson.build
@@ -0,0 +1,19 @@
+# SPDX-License-Identifier: LGPL-2.1-or-later
+
+executables += [
+        libexec_template + {
+                'name' : 'systemd-pcrextend',
+                'conditions' : [
+                        'HAVE_BLKID',
+                        'ENABLE_BOOTLOADER',
+                        'HAVE_OPENSSL',
+                        'HAVE_TPM2',
+                ],
+                'sources' : files('pcrextend.c'),
+                'dependencies' : [
+                        libblkid,
+                        libopenssl,
+                        tpm2,
+                ],
+        },
+]

diff --git a/src/boot/pcrphase.c b/src/pcrextend/pcrextend.c
similarity index 98%
rename from src/boot/pcrphase.c
rename to src/pcrextend/pcrextend.c
index 8e57c827a725c5c6532cc446a62fb596428a0b5a..74021374d3253120f4208737fecba72d41808347 100644 (file)
--- a/src/boot/pcrphase.c
+++ b/src/pcrextend/pcrextend.c
@@ -35,14 +35,14 @@ static int help(int argc, char *argv[], void *userdata) {
         _cleanup_free_ char *link = NULL;
         int r;
 
-        r = terminal_urlify_man("systemd-pcrphase", "8", &link);
+        r = terminal_urlify_man("systemd-pcrextend", "8", &link);
         if (r < 0)
                 return log_oom();
 
         printf("%1$s  [OPTIONS...] WORD\n"
                "%1$s  [OPTIONS...] --file-system=PATH\n"
                "%1$s  [OPTIONS...] --machine-id\n"
-               "\n%5$sMeasure boot phase into TPM2 PCR 11.%6$s\n"
+               "\n%5$sExtend a TPM2 PCR with boot phase, machine ID, or file system ID.%6$s\n"
                "\n%3$sOptions:%4$s\n"
                "  -h --help              Show this help\n"
                "     --version           Print version\n"

diff --git a/test/units/testsuite-70.sh b/test/units/testsuite-70.sh
index 6480c46bf8c90716c9e5e92a4a60ca992c3b2380..3c534235730aebe6758c6012d3115fb8d73086e6 100755 (executable)
--- a/test/units/testsuite-70.sh
+++ b/test/units/testsuite-70.sh
@@ -5,7 +5,7 @@ set -o pipefail
 
 SD_CRYPTSETUP="/usr/lib/systemd/systemd-cryptsetup"
 SD_MEASURE="/usr/lib/systemd/systemd-measure"
-SD_PCRPHASE="/usr/lib/systemd/systemd-pcrphase"
+SD_PCREXTEND="/usr/lib/systemd/systemd-pcrextend"
 export SYSTEMD_LOG_LEVEL=debug
 
 cryptsetup_has_token_plugin_support() {
@@ -249,12 +249,12 @@ else
     echo "$SD_MEASURE or PCR sysfs files not found, skipping signed PCR policy test case"
 fi
 
-if [[ -x "$SD_PCRPHASE" ]] && tpm_has_pcr sha256 11 && tpm_has_pcr sha256 15; then
+if [[ -x "$SD_PCREXTEND" ]] && tpm_has_pcr sha256 11 && tpm_has_pcr sha256 15; then
     # Let's measure the machine ID
     tpm2_pcrread sha256:15 -Q -o /tmp/oldpcr15
     mv /etc/machine-id /etc/machine-id.save
     echo 994013bf23864ee7992eab39a96dd3bb >/etc/machine-id
-    SYSTEMD_FORCE_MEASURE=1 "$SD_PCRPHASE" --machine-id
+    SYSTEMD_FORCE_MEASURE=1 "$SD_PCREXTEND" --machine-id
     mv /etc/machine-id.save /etc/machine-id
     tpm2_pcrread sha256:15 -Q -o /tmp/newpcr15
 
@@ -270,7 +270,7 @@ if [[ -x "$SD_PCRPHASE" ]] && tpm_has_pcr sha256 11 && tpm_has_pcr sha256 15; th
 
     # And similar for the boot phase measurement into PCR 11
     tpm2_pcrread sha256:11 -Q -o /tmp/oldpcr11
-    SYSTEMD_FORCE_MEASURE=1 "$SD_PCRPHASE" foobar
+    SYSTEMD_FORCE_MEASURE=1 "$SD_PCREXTEND" foobar
     tpm2_pcrread sha256:11 -Q -o /tmp/newpcr11
 
     diff /tmp/newpcr11 \
@@ -284,7 +284,7 @@ if [[ -x "$SD_PCRPHASE" ]] && tpm_has_pcr sha256 11 && tpm_has_pcr sha256 15; th
 
     rm -f /tmp/oldpcr11 /tmp/newpcr11
 else
-    echo "$SD_PCRPHASE or PCR sysfs files not found, skipping PCR extension test case"
+    echo "$SD_PCREXTEND or PCR sysfs files not found, skipping PCR extension test case"
 fi
 
 # Ensure that sandboxing doesn't stop creds from being accessible

diff --git a/units/systemd-pcrfs-root.service.in b/units/systemd-pcrfs-root.service.in
index da3438c576c6f187010a68ffc2c3fa82b7726496..d7941fc1f655adea2d75055d2c3284ac886b58af 100644 (file)
--- a/units/systemd-pcrfs-root.service.in
+++ b/units/systemd-pcrfs-root.service.in
@@ -21,4 +21,4 @@ ConditionPathExists=/sys/firmware/efi/efivars/StubPcrKernelImage-4a67b082-0a4c-4
 [Service]
 Type=oneshot
 RemainAfterExit=yes
-ExecStart={{LIBEXECDIR}}/systemd-pcrphase --graceful --file-system=/
+ExecStart={{LIBEXECDIR}}/systemd-pcrextend --graceful --file-system=/

diff --git a/units/systemd-pcrfs@.service.in b/units/systemd-pcrfs@.service.in
index 59a3ece3c5cc84894f9c6535679383ffb3a77154..9ada988f5bdcbf0d8b5fce926b17946429a5e16b 100644 (file)
--- a/units/systemd-pcrfs@.service.in
+++ b/units/systemd-pcrfs@.service.in
@@ -22,4 +22,4 @@ ConditionPathExists=/sys/firmware/efi/efivars/StubPcrKernelImage-4a67b082-0a4c-4
 [Service]
 Type=oneshot
 RemainAfterExit=yes
-ExecStart={{LIBEXECDIR}}/systemd-pcrphase --graceful --file-system=%f
+ExecStart={{LIBEXECDIR}}/systemd-pcrextend --graceful --file-system=%f

diff --git a/units/systemd-pcrmachine.service.in b/units/systemd-pcrmachine.service.in
index 544edb4b7b25a893cbc7ac2512f279fd7c818f94..9088a66acff459454aff69667b26b702d3c2d907 100644 (file)
--- a/units/systemd-pcrmachine.service.in
+++ b/units/systemd-pcrmachine.service.in
@@ -20,4 +20,4 @@ ConditionPathExists=/sys/firmware/efi/efivars/StubPcrKernelImage-4a67b082-0a4c-4
 [Service]
 Type=oneshot
 RemainAfterExit=yes
-ExecStart={{LIBEXECDIR}}/systemd-pcrphase --graceful --machine-id
+ExecStart={{LIBEXECDIR}}/systemd-pcrextend --graceful --machine-id

diff --git a/units/systemd-pcrphase-initrd.service.in b/units/systemd-pcrphase-initrd.service.in
index 69dcbceaac78706bdb9b22530f332e2039d7912b..357c7c58696a4f91dce570f8eef0b61f913196d6 100644 (file)
--- a/units/systemd-pcrphase-initrd.service.in
+++ b/units/systemd-pcrphase-initrd.service.in
@@ -20,5 +20,5 @@ ConditionPathExists=/sys/firmware/efi/efivars/StubPcrKernelImage-4a67b082-0a4c-4
 [Service]
 Type=oneshot
 RemainAfterExit=yes
-ExecStart={{LIBEXECDIR}}/systemd-pcrphase --graceful enter-initrd
-ExecStop={{LIBEXECDIR}}/systemd-pcrphase --graceful leave-initrd
+ExecStart={{LIBEXECDIR}}/systemd-pcrextend --graceful enter-initrd
+ExecStop={{LIBEXECDIR}}/systemd-pcrextend --graceful leave-initrd

diff --git a/units/systemd-pcrphase-sysinit.service.in b/units/systemd-pcrphase-sysinit.service.in
index 55fae49aa860e46e232017ebfe0d029f812efe73..5ca986fdf739543e51a993059b847cd125c7a485 100644 (file)
--- a/units/systemd-pcrphase-sysinit.service.in
+++ b/units/systemd-pcrphase-sysinit.service.in
@@ -21,5 +21,5 @@ ConditionPathExists=/sys/firmware/efi/efivars/StubPcrKernelImage-4a67b082-0a4c-4
 [Service]
 Type=oneshot
 RemainAfterExit=yes
-ExecStart={{LIBEXECDIR}}/systemd-pcrphase --graceful sysinit
-ExecStop={{LIBEXECDIR}}/systemd-pcrphase --graceful final
+ExecStart={{LIBEXECDIR}}/systemd-pcrextend --graceful sysinit
+ExecStop={{LIBEXECDIR}}/systemd-pcrextend --graceful final

diff --git a/units/systemd-pcrphase.service.in b/units/systemd-pcrphase.service.in
index c5170cec93b0eeb98273a3b34d074ffdc5c2b3bb..88d41c2c5d52f2513b0194ee55a4000a9c2c149a 100644 (file)
--- a/units/systemd-pcrphase.service.in
+++ b/units/systemd-pcrphase.service.in
@@ -19,5 +19,5 @@ ConditionPathExists=/sys/firmware/efi/efivars/StubPcrKernelImage-4a67b082-0a4c-4
 [Service]
 Type=oneshot
 RemainAfterExit=yes
-ExecStart={{LIBEXECDIR}}/systemd-pcrphase --graceful ready
-ExecStop={{LIBEXECDIR}}/systemd-pcrphase --graceful shutdown
+ExecStart={{LIBEXECDIR}}/systemd-pcrextend --graceful ready
+ExecStop={{LIBEXECDIR}}/systemd-pcrextend --graceful shutdown