From 408ab988dbf6723871afd3503d11bd0deb50f846 Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Tue, 2 Jul 2024 16:01:47 +0200 Subject: tmpfiles: add separate fragment for stuff we copy from .extra/ into /run/systemd MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Let's move copying out the PCR signature/key into its own tmpfiles snippet. And then let's add support for copying out the profile + os-release information systemd-stub now places in the invoked initrd. That way these four pieces of information are available even after the initrd→host transition. --- tmpfiles.d/20-systemd-stub.conf.in | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) create mode 100644 tmpfiles.d/20-systemd-stub.conf.in (limited to 'tmpfiles.d/20-systemd-stub.conf.in') diff --git a/tmpfiles.d/20-systemd-stub.conf.in b/tmpfiles.d/20-systemd-stub.conf.in new file mode 100644 index 0000000000..910d943cad --- /dev/null +++ b/tmpfiles.d/20-systemd-stub.conf.in @@ -0,0 +1,19 @@ +# This file is part of systemd. +# +# systemd is free software; you can redistribute it and/or modify it +# under the terms of the GNU Lesser General Public License as published by +# the Free Software Foundation; either version 2.1 of the License, or +# (at your option) any later version. + +# See tmpfiles.d(5) for details + +# Copy systemd-stub provided metadata such as PCR signature and public key file +# from initrd into /run/, so that it will survive the initrd stage + +C /run/systemd/stub/profile 0444 root root - /.extra/profile +C /run/systemd/stub/os-release 0444 root root - /.extra/os-release + +{% if ENABLE_TPM %} +C /run/systemd/tpm2-pcr-signature.json 0444 root root - /.extra/tpm2-pcr-signature.json +C /run/systemd/tpm2-pcr-public-key.pem 0444 root root - /.extra/tpm2-pcr-public-key.pem +{% endif %} -- cgit v1.2.3