From 7215060a8449a84fc892c150a387c54e7383562c Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Tue, 30 Jun 2026 10:17:35 +0200 Subject: [PATCH 1/2] specs: tweak wording around OS separator The measurement happens as soon as the TPM device pops up for the first time. That might be shortly beofre the initrd is left, but that's coincidence, and not scheduled like that. Hence correct the language. Follow-up for: c36f6d20161a5e512c3c1f0f6cd28337322e3e06 --- specs/linux_tpm_pcr_registry.md | 32 ++++++++++++++++++-------------- 1 file changed, 18 insertions(+), 14 deletions(-) diff --git a/specs/linux_tpm_pcr_registry.md b/specs/linux_tpm_pcr_registry.md index 108b95b..2c99c5d 100644 --- a/specs/linux_tpm_pcr_registry.md +++ b/specs/linux_tpm_pcr_registry.md @@ -94,7 +94,7 @@ In both cases it is important that data measured into the PCRs is carefully chos systemd-pcrosseparator.service 🚀 Userspace - os-separator barrier when leaving initrd + os-separator barrier when the TPM device becomes available to userspace /run/log/systemd/tpm2-measure.log n/a @@ -112,7 +112,7 @@ In both cases it is important that data measured into the PCRs is carefully chos systemd-pcrosseparator.service 🚀 Userspace - os-separator barrier when leaving initrd + os-separator barrier when the TPM device becomes available to userspace /run/log/systemd/tpm2-measure.log n/a @@ -130,7 +130,7 @@ In both cases it is important that data measured into the PCRs is carefully chos systemd-pcrosseparator.service 🚀 Userspace - os-separator barrier when leaving initrd + os-separator barrier when the TPM device becomes available to userspace /run/log/systemd/tpm2-measure.log n/a @@ -148,7 +148,7 @@ In both cases it is important that data measured into the PCRs is carefully chos systemd-pcrosseparator.service 🚀 Userspace - os-separator barrier when leaving initrd + os-separator barrier when the TPM device becomes available to userspace /run/log/systemd/tpm2-measure.log n/a @@ -166,7 +166,7 @@ In both cases it is important that data measured into the PCRs is carefully chos systemd-pcrosseparator.service 🚀 Userspace - os-separator barrier when leaving initrd + os-separator barrier when the TPM device becomes available to userspace /run/log/systemd/tpm2-measure.log n/a @@ -193,7 +193,7 @@ In both cases it is important that data measured into the PCRs is carefully chos systemd-pcrosseparator.service 🚀 Userspace - os-separator barrier when leaving initrd + os-separator barrier when the TPM device becomes available to userspace /run/log/systemd/tpm2-measure.log n/a @@ -202,7 +202,7 @@ In both cases it is important that data measured into the PCRs is carefully chos

6

systemd-pcrosseparator.service 🚀 Userspace - os-separator barrier when leaving initrd + os-separator barrier when the TPM device becomes available to userspace /run/log/systemd/tpm2-measure.log n/a @@ -220,7 +220,7 @@ In both cases it is important that data measured into the PCRs is carefully chos systemd-pcrosseparator.service 🚀 Userspace - os-separator barrier when leaving initrd + os-separator barrier when the TPM device becomes available to userspace /run/log/systemd/tpm2-measure.log n/a @@ -274,7 +274,7 @@ In both cases it is important that data measured into the PCRs is carefully chos systemd-pcrosseparator.service 🚀 Userspace - os-separator barrier when leaving initrd + os-separator barrier when the TPM device becomes available to userspace /run/log/systemd/tpm2-measure.log n/a @@ -319,7 +319,7 @@ In both cases it is important that data measured into the PCRs is carefully chos systemd-pcrosseparator.service 🚀 Userspace - os-separator barrier when leaving initrd + os-separator barrier when the TPM device becomes available to userspace /run/log/systemd/tpm2-measure.log n/a @@ -337,7 +337,7 @@ In both cases it is important that data measured into the PCRs is carefully chos systemd-pcrosseparator.service 🚀 Userspace - os-separator barrier when leaving initrd + os-separator barrier when the TPM device becomes available to userspace /run/log/systemd/tpm2-measure.log n/a @@ -355,7 +355,7 @@ In both cases it is important that data measured into the PCRs is carefully chos systemd-pcrosseparator.service 🚀 Userspace - os-separator barrier when leaving initrd + os-separator barrier when the TPM device becomes available to userspace /run/log/systemd/tpm2-measure.log n/a @@ -402,9 +402,13 @@ PCR 5 changes when partitions are added, modified, or removed. PCR 7 changes when UEFI SecureBoot mode is enabled/disabled, or firmware certificates (PK, KEK, db, dbx, …) are updated. The shim project will measure most of its (non-MOK) certificates and SBAT data into this PCR. + [systemd-pcrosseparator.service](https://www.freedesktop.org/software/systemd/man/systemd-pcrosseparator.service.html) -extends PCRs 0–7, 9, 12–14 with the literal word `os-separator` as a barrier when leaving the initrd, -so the PCRs differ between the initrd and the main OS. +extends PCRs 0–7, 9, 12–14 with the literal word `os-separator` as a barrier measurement when userspace first +sees the TPM device, so that firmware and OS measurements are clearly isolated from each other and +distinguishable. This provides protection for systems where the firmware does not generate the UEFI-mandated +measurement on its own, or doesn't natively support TPMs at all (for example because the TPM is emulated in +software). PCR 11 and 15 as shown in the list above are used by multiple components of systemd. These are not conflicting uses; From a5dbe8db72246224491e01cdc12c8b4e103d427b Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Tue, 30 Jun 2026 10:29:30 +0200 Subject: [PATCH 2/2] pcr-registry: document systemd-stub's SMBIOS measurement --- specs/linux_tpm_pcr_registry.md | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/specs/linux_tpm_pcr_registry.md b/specs/linux_tpm_pcr_registry.md index 2c99c5d..12daee5 100644 --- a/specs/linux_tpm_pcr_registry.md +++ b/specs/linux_tpm_pcr_registry.md @@ -108,6 +108,15 @@ In both cases it is important that data measured into the PCRs is carefully chos n/a + + + systemd-stub 🚀 + UEFI Stub + Measurement of SMBIOS Type 1, 2, 11 as set when the UEFI stub takes over + UEFI TPM event log + n/a + + systemd-pcrosseparator.service 🚀 @@ -390,6 +399,12 @@ In both cases it is important that data measured into the PCRs is carefully chos PCR 0 changes on firmware updates; PCR 1 changes on basic hardware/CPU/RAM replacements. +[systemd-stub](https://www.freedesktop.org/software/systemd/man/latest/systemd-stub.html) measures SMBIOS +Type 1, 2, 11 objects when it is executed. These objects are used to parameterize the OS, and hence +important to measure. Some firmwares do not measure SMBIOS structures on their own, hence this is supposed to +fill the gap on such systems. Note that the Type 1 field for the wakeup source is masked to zero before the +measurement is made, in order to provide stable measurements independently of system wakeup sources. + PCR 4 changes on boot loader updates. The shim project will measure the PE binary it chain loads into this PCR. If the Linux kernel is invoked as UEFI PE binary, it is measured here, too.