Index · Directives systemd 251


systemd-measure — Pre-calculate expected TPM2 PCR values for booted unified kernel images


/usr/lib/systemd/systemd-measure [OPTIONS...]


Note: this command is experimental for now. While it is likely to become a regular component of systemd, it might still change in behaviour and interface.

systemd-measure is a tool that may be used to pre-calculate the expected TPM2 PCR 11 values that should be seen when a unified Linux kernel image based on systemd-stub(7) is booted up. It accepts paths to the ELF kernel image file, initial ram disk image file, devicetree file, kernel command line file, os-release(5) file, and boot splash file that make up the unified kernel image, and determines the PCR values expected to be in place after booting the image. Calculation starts with a zero-initialized PCR 11, and is executed in a fashion compatible with what systemd-stub does at boot.


The following commands are understood:


This is the default command if none is specified. This queries the local system's TPM2 PCR 11+12+13 values and displays them. The data is written in a similar format as the calculate command below, and may be used to quickly compare expectation with reality.


Pre-calculate the expected value seen in PCR register 11 after boot-up of a unified kernel image consisting of the components specified with --linux=, --osrel=, --cmdline=, --initrd=, --splash=, --dtb=, see below. Only --linux= is mandatory.


The following options are understood:

--linux=PATH, --osrel=PATH, --cmdline=PATH, --initrd=PATH, --splash=PATH, --dtb=PATH

When used with the calculate verb, configures the files to read the unified kernel image components from. Each option corresponds with the equally named section in the unified kernel PE file. The --linux= switch expects the path to the ELF kernel file that the unified PE kernel will wrap. All switches except --linux= are optional. Each option may be used at most once.


Controls the PCR banks to pre-calculate the PCR values for – in case calculate is invoked –, or the banks to show in the status output. May be used more then once to specify multiple banks. If not specified, defaults to the four banks "sha1", "sha256", "sha384", "sha512".

-h, --help

Print a short help text and exit.


Print a short version string and exit.


Example 1. Generate a unified kernel image, and calculate the expected TPM PCR 11 value

# objcopy \
    --add-section .linux=vmlinux --change-section-vma .linux=0x2000000 \
    --add-section .osrel=os-release.txt --change-section-vma .osrel=0x20000 \
    --add-section .cmdline=cmdline.txt --change-section-vma .cmdline=0x30000 \
    --add-section .initrd=initrd.cpio --change-section-vma .initrd=0x3000000 \
    --add-section .splash=splash.bmp --change-section-vma .splash=0x100000 \
    --add-section .dtb=devicetree.dtb --change-section-vma .dtb=0x40000 \
    /usr/lib/systemd/boot/efi/linuxx64.efi.stub \
# systemd-measure calculate \
     --linux=vmlinux \
     --osrel=os-release \
     --cmdline=cmdline.txt \
     --initrd=initrd.cpio \
     --splash=splash.bmp \

Exit status

On success, 0 is returned, a non-zero failure code otherwise.

See Also

systemd(1), systemd-stub(7), objcopy(1)