Systemd & TPMs
summary
Systemd now ships concrete TPM tooling: systemd-cryptenroll creates TPM-locked root on first boot and systemd-cryptsetup unlocks disks with TPM/PKCS#11/FIDO; systemd-stub plus UKIs and systemd-measure let vendors predict and sign boot measurements; systemd-pcr-lock generates local NV‑index PCR policies and combines vendor-signed and local PCR policies by key sharding; systemd-pcrlog parses event logs; NV‑PCRs expand measurable state; most components are implemented or merged, while kexec/software-boot handling remains an open problem.
AI-written summary · about
chapters (11)
- 0:00systemd TPM2 integration
- 2:10TPM support goals
- 9:26Status update
- 18:56systemd-pcr-lock explained
- 31:15TPM NV indexes & PCR limits
- 47:47TPM in virtualized & TEE
- 51:40Multi-profile UKIs & measurements
- 54:31kexec reboot challenges
- 1:01:38systemd-confx & remote attestation
- 1:06:09Open problems & future
- 1:17:22Q&A
related talks
47msystemd and TPM2
32mWhat's new in systemd
51mApplications of TPM 2.0
33mEnhancing Systemd Security Using TPM 2.0
39mTPM Is No Silver Bullet: Pitfalls in Embedded Device Security
28mThe TPM as an everyday security tool
51mSecuring Embedded Linux Systems with TPM 2.0
42mRecent TPM Security Enhancements to the Linux Kernel