units: add ConditionSecurity=tpm2 to systemd-tpm2-setup units

ConditionSecurity=measured-uki can be true even with TPM 1.2 which we
don't support, so add an explicit check for TPM 2.0.

Fixes https://github.com/systemd/systemd/issues/30650

Follow-up for 2e64cb71b9c0160c3

diff --git a/units/systemd-tpm2-setup-early.service.in b/units/systemd-tpm2-setup-early.service.in
index c1597ea3f9fd6f730b9fbc5cf97546d805b7337c..57fe5e2537a8513583b178227e809b19fe304cc4 100644 (file)
--- a/units/systemd-tpm2-setup-early.service.in
+++ b/units/systemd-tpm2-setup-early.service.in
@@ -14,6 +14,7 @@ DefaultDependencies=no
 Conflicts=shutdown.target
 Before=sysinit.target shutdown.target
 ConditionSecurity=measured-uki
+ConditionSecurity=tpm2
 ConditionPathExists=!/run/systemd/tpm2-srk-public-key.pem
 
 [Service]

diff --git a/units/systemd-tpm2-setup.service.in b/units/systemd-tpm2-setup.service.in
index 6c99f3af0a6b258a3df6562cc57c22825df64b6d..9d882d690faa1f991e99fac3009f2ad0d76d3153 100644 (file)
--- a/units/systemd-tpm2-setup.service.in
+++ b/units/systemd-tpm2-setup.service.in
@@ -16,6 +16,7 @@ After=systemd-tpm2-setup-early.service systemd-remount-fs.service
 Before=sysinit.target shutdown.target
 RequiresMountsFor=/var/lib/systemd/tpm2-srk-public-key.pem
 ConditionSecurity=measured-uki
+ConditionSecurity=tpm2
 ConditionPathExists=!/etc/initrd-release
 
 [Service]