Index · Directives systemd 251

Name

systemd-measure — Pre-calculate expected TPM2 PCR values for booted unified kernel images

Synopsis

/usr/lib/systemd/systemd-measure [OPTIONS...]

Description

Note: this command is experimental for now. While it is likely to become a regular component of systemd, it might still change in behaviour and interface.

systemd-measure is a tool that may be used to pre-calculate the expected TPM2 PCR 11 values that should be seen when a unified Linux kernel image based on systemd-stub(7) is booted up. It accepts paths to the ELF kernel image file, initial ram disk image file, devicetree file, kernel command line file, os-release(5) file, and boot splash file that make up the unified kernel image, and determines the PCR values expected to be in place after booting the image. Calculation starts with a zero-initialized PCR 11, and is executed in a fashion compatible with what systemd-stub does at boot.

Commands

The following commands are understood:

status

This is the default command if none is specified. This queries the local system's TPM2 PCR 11+12+13 values and displays them. The data is written in a similar format as the calculate command below, and may be used to quickly compare expectation with reality.

calculate

Pre-calculate the expected value seen in PCR register 11 after boot-up of a unified kernel image consisting of the components specified with --linux=, --osrel=, --cmdline=, --initrd=, --splash=, --dtb=, see below. Only --linux= is mandatory.

Options

The following options are understood:

--linux=PATH, --osrel=PATH, --cmdline=PATH, --initrd=PATH, --splash=PATH, --dtb=PATH

When used with the calculate verb, configures the files to read the unified kernel image components from. Each option corresponds with the equally named section in the unified kernel PE file. The --linux= switch expects the path to the ELF kernel file that the unified PE kernel will wrap. All switches except --linux= are optional. Each option may be used at most once.

--bank=DIGEST

Controls the PCR banks to pre-calculate the PCR values for – in case calculate is invoked –, or the banks to show in the status output. May be used more then once to specify multiple banks. If not specified, defaults to the four banks "sha1", "sha256", "sha384", "sha512".

-h, --help

Print a short help text and exit.

--version

Print a short version string and exit.

Examples

Example 1. Generate a unified kernel image, and calculate the expected TPM PCR 11 value

# objcopy \
    --add-section .linux=vmlinux --change-section-vma .linux=0x2000000 \
    --add-section .osrel=os-release.txt --change-section-vma .osrel=0x20000 \
    --add-section .cmdline=cmdline.txt --change-section-vma .cmdline=0x30000 \
    --add-section .initrd=initrd.cpio --change-section-vma .initrd=0x3000000 \
    --add-section .splash=splash.bmp --change-section-vma .splash=0x100000 \
    --add-section .dtb=devicetree.dtb --change-section-vma .dtb=0x40000 \
    /usr/lib/systemd/boot/efi/linuxx64.efi.stub \
    foo.efi
# systemd-measure calculate \
     --linux=vmlinux \
     --osrel=os-release \
     --cmdline=cmdline.txt \
     --initrd=initrd.cpio \
     --splash=splash.bmp \
     --dtb=devicetree.dtb
11:sha1=d775a7b4482450ac77e03ee19bda90bd792d6ec7
11:sha256=bc6170f9ce28eb051ab465cd62be8cf63985276766cf9faf527ffefb66f45651
11:sha384=1cf67dff4757e61e5a73d2a21a6694d668629bbc3761747d493f7f49ad720be02fd07263e1f93061243aec599d1ee4b4
11:sha512=8e79acd3ddbbc8282e98091849c3530f996303c8ac8e87a3b2378b71c8b3a6e86d5c4f41ecea9e1517090c3e8ec0c714821032038f525f744960bcd082d937da

Exit status

On success, 0 is returned, a non-zero failure code otherwise.

See Also

systemd(1), systemd-stub(7), objcopy(1)