diff --git a/nixos/modules/system/boot/systemd/tpm2.nix b/nixos/modules/system/boot/systemd/tpm2.nix index dcdd08b24783..2703d60428f1 100644 --- a/nixos/modules/system/boot/systemd/tpm2.nix +++ b/nixos/modules/system/boot/systemd/tpm2.nix @@ -9,19 +9,8 @@ imports = [ (lib.mkRenamedOptionModule - [ - "boot" - "initrd" - "systemd" - "enableTpm2" - ] - [ - "boot" - "initrd" - "systemd" - "tpm2" - "enable" - ] + [ "boot" "initrd" "systemd" "enableTpm2" ] + [ "boot" "initrd" "systemd" "tpm2" "enable" ] ) ]; @@ -31,13 +20,18 @@ defaultText = "systemd.package.withTpm2Units"; }; + systemd.tpm2.pcrphases.enable = lib.mkEnableOption "systemd boot phase measurements"; + boot.initrd.systemd.tpm2.enable = lib.mkEnableOption "systemd initrd TPM2 support" // { default = config.boot.initrd.systemd.package.withTpm2Units; defaultText = "boot.initrd.systemd.package.withTpm2Units"; }; + + boot.initrd.systemd.tpm2.pcrphases.enable = + lib.mkEnableOption "systemd initrd boot phase measurements"; }; - # TODO: pcrphase, pcrextend, pcrfs, pcrmachine + # TODO: pcrextend, pcrfs, pcrmachine config = lib.mkMerge [ # Stage 2 ( @@ -52,6 +46,19 @@ ]; } ) + ( + let + cfg = config.systemd; + in + lib.mkIf (cfg.tpm2.enable && cfg.tpm2.pcrphases.enable) { + systemd.additionalUpstreamSystemUnits = [ + "systemd-pcrphase.service" + "systemd-pcrphase-sysinit.service" + ]; + systemd.services.systemd-pcrphase.wantedBy = [ "sysinit.target" ]; + systemd.services.systemd-pcrphase-sysinit.wantedBy = [ "sysinit.target" ]; + } + ) # Stage 1 ( @@ -77,5 +84,15 @@ ]; } ) + ( + let + cfg = config.boot.initrd.systemd; + in + lib.mkIf (cfg.enable && cfg.tpm2.enable && cfg.tpm2.pcrphases.enable) { + boot.initrd.systemd.additionalUpstreamUnits = [ "systemd-pcrphase-initrd.service" ]; + boot.initrd.systemd.services.systemd-pcrphase-initrd.wantedBy = [ "initrd.target" ]; + boot.initrd.systemd.storePaths = [ "${cfg.package}/lib/systemd/systemd-pcrextend" ]; + } + ) ]; }