diff --git a/specs/linux_tpm_pcr_registry.md b/specs/linux_tpm_pcr_registry.md
index d7e9ad2..108b95b 100644
--- a/specs/linux_tpm_pcr_registry.md
+++ b/specs/linux_tpm_pcr_registry.md
@@ -90,6 +90,15 @@ In both cases it is important that data measured into the PCRs is carefully chos
| n/a |
+
+ |
+ systemd-pcrosseparator.service 🚀 |
+ Userspace |
+ os-separator barrier when leaving initrd |
+ /run/log/systemd/tpm2-measure.log |
+ n/a |
+
+
1 |
Firmware 💻 |
@@ -99,6 +108,15 @@ In both cases it is important that data measured into the PCRs is carefully chos
n/a |
+
+ |
+ systemd-pcrosseparator.service 🚀 |
+ Userspace |
+ os-separator barrier when leaving initrd |
+ /run/log/systemd/tpm2-measure.log |
+ n/a |
+
+
2 |
Firmware 💻 |
@@ -108,6 +126,15 @@ In both cases it is important that data measured into the PCRs is carefully chos
n/a |
+
+ |
+ systemd-pcrosseparator.service 🚀 |
+ Userspace |
+ os-separator barrier when leaving initrd |
+ /run/log/systemd/tpm2-measure.log |
+ n/a |
+
+
3 |
Firmware 💻 |
@@ -117,6 +144,15 @@ In both cases it is important that data measured into the PCRs is carefully chos
n/a |
+
+ |
+ systemd-pcrosseparator.service 🚀 |
+ Userspace |
+ os-separator barrier when leaving initrd |
+ /run/log/systemd/tpm2-measure.log |
+ n/a |
+
+
4 |
Firmware 💻 |
@@ -126,6 +162,15 @@ In both cases it is important that data measured into the PCRs is carefully chos
n/a |
+
+ |
+ systemd-pcrosseparator.service 🚀 |
+ Userspace |
+ os-separator barrier when leaving initrd |
+ /run/log/systemd/tpm2-measure.log |
+ n/a |
+
+
5 |
Firmware 💻 |
@@ -144,6 +189,24 @@ In both cases it is important that data measured into the PCRs is carefully chos
n/a |
+
+ |
+ systemd-pcrosseparator.service 🚀 |
+ Userspace |
+ os-separator barrier when leaving initrd |
+ /run/log/systemd/tpm2-measure.log |
+ n/a |
+
+
+
+ 6 |
+ systemd-pcrosseparator.service 🚀 |
+ Userspace |
+ os-separator barrier when leaving initrd |
+ /run/log/systemd/tpm2-measure.log |
+ n/a |
+
+
7 |
Firmware 💻 |
@@ -153,6 +216,15 @@ In both cases it is important that data measured into the PCRs is carefully chos
n/a |
+
+ |
+ systemd-pcrosseparator.service 🚀 |
+ Userspace |
+ os-separator barrier when leaving initrd |
+ /run/log/systemd/tpm2-measure.log |
+ n/a |
+
+
8 |
grub 🍲 |
@@ -198,6 +270,15 @@ In both cases it is important that data measured into the PCRs is carefully chos
n/a |
+
+ |
+ systemd-pcrosseparator.service 🚀 |
+ Userspace |
+ os-separator barrier when leaving initrd |
+ /run/log/systemd/tpm2-measure.log |
+ n/a |
+
+
10 |
IMA 📐 |
@@ -234,6 +315,15 @@ In both cases it is important that data measured into the PCRs is carefully chos
in EFI variable StubPcrKernelParameters |
+
+ |
+ systemd-pcrosseparator.service 🚀 |
+ Userspace |
+ os-separator barrier when leaving initrd |
+ /run/log/systemd/tpm2-measure.log |
+ n/a |
+
+
13 |
systemd-stub 🚀 |
@@ -243,6 +333,15 @@ In both cases it is important that data measured into the PCRs is carefully chos
in EFI variable StubPcrInitRDSysExts |
+
+ |
+ systemd-pcrosseparator.service 🚀 |
+ Userspace |
+ os-separator barrier when leaving initrd |
+ /run/log/systemd/tpm2-measure.log |
+ n/a |
+
+
14 |
shim 🔑 |
@@ -252,6 +351,15 @@ In both cases it is important that data measured into the PCRs is carefully chos
n/a |
+
+ |
+ systemd-pcrosseparator.service 🚀 |
+ Userspace |
+ os-separator barrier when leaving initrd |
+ /run/log/systemd/tpm2-measure.log |
+ n/a |
+
+
15 |
systemd-cryptsetup@.service 🚀 |
@@ -294,6 +402,9 @@ PCR 5 changes when partitions are added, modified, or removed.
PCR 7 changes when UEFI SecureBoot mode is enabled/disabled, or firmware certificates (PK, KEK, db, dbx, …) are updated.
The shim project will measure most of its (non-MOK) certificates and SBAT data into this PCR.
+[systemd-pcrosseparator.service](https://www.freedesktop.org/software/systemd/man/systemd-pcrosseparator.service.html)
+extends PCRs 0–7, 9, 12–14 with the literal word `os-separator` as a barrier when leaving the initrd,
+so the PCRs differ between the initrd and the main OS.
PCR 11 and 15 as shown in the list above are used by multiple components of systemd.
These are not conflicting uses;