INFRA Signal 318
Mkinitcpio >=42 requires manual intervention for TPM2-based unlocking of LUKS devices
↗
Illustration only Photo by Albert Stoynov on Unsplash
Starting with package version 42-1, mkinitcpio requires users to manually re-enroll TPM2 for LUKS unlocking.
This change necessitates additional steps for users who rely on TPM2 for unlocking LUKS devices, which could impact system boot processes. Engineers must ensure their configurations are updated to avoid boot failures. Understanding the implications of PCR measurements is crucial for maintaining secure access to encrypted partitions.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
Mkinitcpio version 42-1 introduces a new systemd hook affecting TPM2 functionality.
Users must manually re-enroll their TPM2 configurations to maintain access to LUKS partitions.
Consulting systemd-cryptenroll and related documentation is essential for proper setup.
THE READ
What the cluster adds up to.
The update to mkinitcpio version 42-1 introduces a requirement for manual intervention when using TPM2 for unlocking LUKS devices. This change stems from the inclusion of systemd-pcrosseparator.service, which modifies how PCR values are measured, specifically affecting values 0-7, 9, and 12-14. Users previously relying on automatic TPM2 unlocking will need to adjust their configurations accordingly to ensure continued access to encrypted partitions.
The necessity to re-enroll TPM2 means that engineers must take proactive steps to avoid potential boot issues. If these adjustments are not made, systems may fail to unlock during the boot process, leading to downtime. The manual process might also require additional time and understanding of the new systemd hooks and their implications for security.
Where this change stops working is in environments where users have not updated their mkinitcpio configurations or fail to consult the necessary documentation. If users depend on custom policies or have disabled the systemd-pcrlock-make-policy.service, they must be particularly cautious as this could further complicate the unlocking process. Ensuring that configurations are aligned with the updated version is vital for maintaining system integrity.
Written by elseif from the cluster below · checked for specifics the sources never containedTHE CLUSTER