mirrors/meta-security
1
0
Fork 0
mirror of https://git.yoctoproject.org/meta-security synced 2026-01-12 03:10:13 +00:00
Code Issues Projects Releases Wiki Activity

systemd: enable TPM support

Browse Source 
Enable "tpm2" support if "tpm2" is in DISTRO_FEATURES.
Also enable cryptsetup, openssl and repart features which
are needed to use TPM device to encrypt filesystems with
systemd configuration. See:

https://www.freedesktop.org/software/systemd/man/latest/systemd-repart.html#--tpm2-device=

Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
This commit is contained in:
Mikko Rapeli
2024-12-20 16:04:35 +02:00
committed by Armin Kuster
parent b22814dc2a
commit 6eb3098e57
1 changed files with 17 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
meta-tpm/recipes-core/systemd/systemd_%.bbappend Normal file
View File

@@ -0,0 +1,17 @@
PACKAGECONFIG:append = " ${@bb.utils.contains('DISTRO_FEATURES', 'tpm2', 'tpm2', '', d)}"
# for encrypted filesystems
PACKAGECONFIG:append = " \
${@bb.utils.contains('DISTRO_FEATURES', 'tpm2', 'cryptsetup cryptsetup-plugins efi openssl repart', '', d)} \
"
# ukify.py and systemd-measure don't work in cross compile environment without
# a tpm2 device, thus switch from measured-uki (new in v256) back to tpm2
# (default before v256).
# TODO: use swtpm-native to calculate TPM measurements
do_install:append() {
if "${@bb.utils.contains('DISTRO_FEATURES', 'tpm2', 'true', 'false', d)}"; then
sed -i -e "s/^ConditionSecurity=measured-uki/ConditionSecurity=tpm2/g" \
$( grep -rl ^ConditionSecurity=measured-uki ${D} )
fi
}