pcrextend: whenever we fail to extend PCRs, reboot immediately

PCR extensions are supposed to be useful for "destroying" the ability to
access TPM bound secrets. Hence, if for some reason we fail to extend a
PCR, it's safer to just reboot, instead of going on without the
extension, leaving secrets potentially accessible which should not be
accessible.

Note that the services exit gracefully if no TPM is found, hence this
should not be triggered on TPM-less systems. However, this enforces that
if there is a TPM that is accessible to Linux and that works properly,
the PCR measurement must complete too.

Inspired by this thread:

https://lists.freedesktop.org/archives/systemd-devel/2025-March/051244.html

diff --git a/units/systemd-pcrfs-root.service.in b/units/systemd-pcrfs-root.service.in
index 5b40a91ca649e3d0d95a4e5f26af9893e68a8723..f774c4c8bf6bf7b6d0bdf94cecaa2d0e1d1f4ad6 100644 (file)
--- a/units/systemd-pcrfs-root.service.in
+++ b/units/systemd-pcrfs-root.service.in
@@ -16,6 +16,7 @@ After=tpm2.target systemd-pcrmachine.service
 Before=shutdown.target
 ConditionPathExists=!/etc/initrd-release
 ConditionSecurity=measured-uki
+FailureAction=reboot-force
 
 [Service]
 Type=oneshot

diff --git a/units/systemd-pcrfs@.service.in b/units/systemd-pcrfs@.service.in
index 203d7b9782e1a3fb95d77ec21328d819734b60f8..3d18fe4d30e1635e039a17db6a199b205d5db6ce 100644 (file)
--- a/units/systemd-pcrfs@.service.in
+++ b/units/systemd-pcrfs@.service.in
@@ -17,6 +17,7 @@ After=%i.mount tpm2.target systemd-pcrfs-root.service
 Before=shutdown.target
 ConditionPathExists=!/etc/initrd-release
 ConditionSecurity=measured-uki
+FailureAction=reboot-force
 
 [Service]
 Type=oneshot

diff --git a/units/systemd-pcrmachine.service.in b/units/systemd-pcrmachine.service.in
index 65caf2ed49280af18bc4b5d1dd11704c0ad21a29..ea2561ef79e3f0dcba1226fd2ed18c380c69e435 100644 (file)
--- a/units/systemd-pcrmachine.service.in
+++ b/units/systemd-pcrmachine.service.in
@@ -16,6 +16,7 @@ After=tpm2.target
 Before=sysinit.target shutdown.target
 ConditionPathExists=!/etc/initrd-release
 ConditionSecurity=measured-uki
+FailureAction=reboot-force
 
 [Service]
 Type=oneshot

diff --git a/units/systemd-pcrphase-factory-reset.service.in b/units/systemd-pcrphase-factory-reset.service.in
index 6267336b30384e6f85fd7f535ec0ca34fe843695..5dbcb0f53f160bd3717d8f9449e99218e3d9f08c 100644 (file)
--- a/units/systemd-pcrphase-factory-reset.service.in
+++ b/units/systemd-pcrphase-factory-reset.service.in
@@ -15,6 +15,7 @@ Conflicts=shutdown.target
 After=tpm2.target
 Before=shutdown.target factory-reset.target
 ConditionSecurity=measured-uki
+FailureAction=reboot-force
 
 [Service]
 Type=oneshot

diff --git a/units/systemd-pcrphase-initrd.service.in b/units/systemd-pcrphase-initrd.service.in
index 6fcf94de76c5f2754d8ea584323147acf8a7dd99..5aba32128c012a0c44bc755ce0444f7482102a38 100644 (file)
--- a/units/systemd-pcrphase-initrd.service.in
+++ b/units/systemd-pcrphase-initrd.service.in
@@ -16,6 +16,7 @@ After=tpm2.target
 Before=sysinit.target cryptsetup-pre.target cryptsetup.target shutdown.target initrd-switch-root.target systemd-sysext.service
 ConditionPathExists=/etc/initrd-release
 ConditionSecurity=measured-uki
+FailureAction=reboot-force
 
 [Service]
 Type=oneshot

diff --git a/units/systemd-pcrphase-storage-target-mode.service.in b/units/systemd-pcrphase-storage-target-mode.service.in
index 2502ac890210d5b08036f5a575b86ce30fa1a0fd..52b53e5b819a8f3bc3009c6409389757e51f3a69 100644 (file)
--- a/units/systemd-pcrphase-storage-target-mode.service.in
+++ b/units/systemd-pcrphase-storage-target-mode.service.in
@@ -16,6 +16,7 @@ After=tpm2.target
 Before=shutdown.target
 ConditionPathExists=/etc/initrd-release
 ConditionSecurity=measured-uki
+FailureAction=reboot-force
 
 [Service]
 Type=oneshot

diff --git a/units/systemd-pcrphase-sysinit.service.in b/units/systemd-pcrphase-sysinit.service.in
index 8c0c0c82a2c7b26c8750e6cf9b64d3a4914dc561..4a01279159d9381300bc92fb89762ea523b85b3b 100644 (file)
--- a/units/systemd-pcrphase-sysinit.service.in
+++ b/units/systemd-pcrphase-sysinit.service.in
@@ -16,6 +16,7 @@ After=sysinit.target tpm2.target
 Before=basic.target shutdown.target
 ConditionPathExists=!/etc/initrd-release
 ConditionSecurity=measured-uki
+FailureAction=reboot-force
 
 [Service]
 Type=oneshot

diff --git a/units/systemd-pcrphase.service.in b/units/systemd-pcrphase.service.in
index 04ace12e14d4eecfbfd9461e5d947c4178b18b70..43459a2fccba0b9af3ec3eb1fffe11494a3efd26 100644 (file)
--- a/units/systemd-pcrphase.service.in
+++ b/units/systemd-pcrphase.service.in
@@ -14,6 +14,7 @@ After=remote-fs.target remote-cryptsetup.target tpm2.target
 Before=systemd-user-sessions.service
 ConditionPathExists=!/etc/initrd-release
 ConditionSecurity=measured-uki
+FailureAction=reboot-force
 
 [Service]
 Type=oneshot