From 16b238e565a83325111b98dd4f4c2a15627d434e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Mon, 29 Jun 2026 12:07:01 +0200 Subject: [PATCH] =?UTF-8?q?tpm-pcr-registry:=20document=20systemd=20extend?= =?UTF-8?q?ing=20PCRs=200=E2=80=937,=209,=2012=E2=80=9314=20with=20"os-sep?= =?UTF-8?q?arator"?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Added to systemd 261 in https://github.com/systemd/systemd/pull/41016/changes/7c27f9f59455b199e12976c76b28b708c525b55c#diff-e185456c303f7a77bef6607af135857668f4b30b67f21ea372d45f7d69927730R24. Co-authored-by: Simran Singh --- specs/linux_tpm_pcr_registry.md | 111 ++++++++++++++++++++++++++++++++ 1 file changed, 111 insertions(+) diff --git a/specs/linux_tpm_pcr_registry.md b/specs/linux_tpm_pcr_registry.md index d7e9ad2..108b95b 100644 --- a/specs/linux_tpm_pcr_registry.md +++ b/specs/linux_tpm_pcr_registry.md @@ -90,6 +90,15 @@ In both cases it is important that data measured into the PCRs is carefully chos n/a + + + systemd-pcrosseparator.service 🚀 + Userspace + os-separator barrier when leaving initrd + /run/log/systemd/tpm2-measure.log + n/a + +

1

Firmware 💻 @@ -99,6 +108,15 @@ In both cases it is important that data measured into the PCRs is carefully chos n/a + + + systemd-pcrosseparator.service 🚀 + Userspace + os-separator barrier when leaving initrd + /run/log/systemd/tpm2-measure.log + n/a + +

2

Firmware 💻 @@ -108,6 +126,15 @@ In both cases it is important that data measured into the PCRs is carefully chos n/a + + + systemd-pcrosseparator.service 🚀 + Userspace + os-separator barrier when leaving initrd + /run/log/systemd/tpm2-measure.log + n/a + +

3

Firmware 💻 @@ -117,6 +144,15 @@ In both cases it is important that data measured into the PCRs is carefully chos n/a + + + systemd-pcrosseparator.service 🚀 + Userspace + os-separator barrier when leaving initrd + /run/log/systemd/tpm2-measure.log + n/a + +

4

Firmware 💻 @@ -126,6 +162,15 @@ In both cases it is important that data measured into the PCRs is carefully chos n/a + + + systemd-pcrosseparator.service 🚀 + Userspace + os-separator barrier when leaving initrd + /run/log/systemd/tpm2-measure.log + n/a + +

5

Firmware 💻 @@ -144,6 +189,24 @@ In both cases it is important that data measured into the PCRs is carefully chos n/a + + + systemd-pcrosseparator.service 🚀 + Userspace + os-separator barrier when leaving initrd + /run/log/systemd/tpm2-measure.log + n/a + + + +

6

+ systemd-pcrosseparator.service 🚀 + Userspace + os-separator barrier when leaving initrd + /run/log/systemd/tpm2-measure.log + n/a + +

7

Firmware 💻 @@ -153,6 +216,15 @@ In both cases it is important that data measured into the PCRs is carefully chos n/a + + + systemd-pcrosseparator.service 🚀 + Userspace + os-separator barrier when leaving initrd + /run/log/systemd/tpm2-measure.log + n/a + +

8

grub 🍲 @@ -198,6 +270,15 @@ In both cases it is important that data measured into the PCRs is carefully chos n/a + + + systemd-pcrosseparator.service 🚀 + Userspace + os-separator barrier when leaving initrd + /run/log/systemd/tpm2-measure.log + n/a + +

10

IMA 📐 @@ -234,6 +315,15 @@ In both cases it is important that data measured into the PCRs is carefully chos in EFI variable StubPcrKernelParameters + + + systemd-pcrosseparator.service 🚀 + Userspace + os-separator barrier when leaving initrd + /run/log/systemd/tpm2-measure.log + n/a + +

13

systemd-stub 🚀 @@ -243,6 +333,15 @@ In both cases it is important that data measured into the PCRs is carefully chos in EFI variable StubPcrInitRDSysExts + + + systemd-pcrosseparator.service 🚀 + Userspace + os-separator barrier when leaving initrd + /run/log/systemd/tpm2-measure.log + n/a + +

14

shim 🔑 @@ -252,6 +351,15 @@ In both cases it is important that data measured into the PCRs is carefully chos n/a + + + systemd-pcrosseparator.service 🚀 + Userspace + os-separator barrier when leaving initrd + /run/log/systemd/tpm2-measure.log + n/a + +

15

systemd-cryptsetup@.service 🚀 @@ -294,6 +402,9 @@ PCR 5 changes when partitions are added, modified, or removed. PCR 7 changes when UEFI SecureBoot mode is enabled/disabled, or firmware certificates (PK, KEK, db, dbx, …) are updated. The shim project will measure most of its (non-MOK) certificates and SBAT data into this PCR. +[systemd-pcrosseparator.service](https://www.freedesktop.org/software/systemd/man/systemd-pcrosseparator.service.html) +extends PCRs 0–7, 9, 12–14 with the literal word `os-separator` as a barrier when leaving the initrd, +so the PCRs differ between the initrd and the main OS. PCR 11 and 15 as shown in the list above are used by multiple components of systemd. These are not conflicting uses;