From: Paul Meyer Date: Wed, 29 Jul 2026 05:21:08 +0000 (+0200) Subject: cryptsetup: measure volume key and keyslot via the pcrextend Varlink service (#43109) X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=HEAD;p=thirdparty%2Fsystemd.git cryptsetup: measure volume key and keyslot via the pcrextend Varlink service (#43109) Motivated by https://github.com/systemd/systemd/pull/43041#discussion_r3595022610. Switch systemd-cryptsetup's volume-key and keyslot measurements from driving the TPM directly (tpm2-util) to the io.systemd.PCRExtend Varlink service, aligning it with how the verity and imds measurements already work. Some notes on decisions taken: - The volume key is sent over the wire. systemd-pcrextend will do the hmac. The socket is root only. Otherwise we would need to do bank negotiation via varlink and pollute the interface with it. - `tpm2-measure-bank=` deprecated/dropped. Same reason as above. - `tpm2-device=` now only affects unlocking. The device for measurements is selected by pcrextend. - Measuring requires the presence of `systemd-pcrextend.socket` in the initrd, should be already given as systemd-veritysetup relies on it, too. - Logs are done on the pcrextend side. --- 57f8a85a219bd358ac32ad9f8459108afca71063