Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add TPM2 systemd-cryptenroll to Tips and Tricks #176

Open
wants to merge 5 commits into
base: master
Choose a base branch
from
Open

Add TPM2 systemd-cryptenroll to Tips and Tricks #176

Changes from 1 commit
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
216c349
Add TPM2 systemd-cryptenroll to Tips and Tricks
stenwt Apr 26, 2024
54c1e07
requested changes
stenwt Apr 27, 2024
43ff4d2
Update tips-and-tricks.adoc
stenwt May 19, 2024
32b875c
Update tips-and-tricks.adoc
stenwt Aug 18, 2024
5ee8159
Update modules/ROOT/pages/tips-and-tricks.adoc
stenwt Aug 22, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 13 additions & 0 deletions modules/ROOT/pages/tips-and-tricks.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -160,3 +160,16 @@ or setup shell `alias`es as needed to make them available to the CLI like so:
$ alias evince="flatpak run org.gnome.Evince"
# or alias evince="org.gnome.Evince"
$ evince

== Enabling TPM2 for LUKS

It is possible to use the TPM2 device in your machine to automatically decrypt your LUKS-encrypted device.

First, enable the needed initramfs and kernel features:

$ sudo rpm-ostree kargs --append=rd.luks.options=tpm2-device=auto
$ sudo rpm-ostree initramfs --enable --arg=-a --arg=systemd-pcrphase
stenwt marked this conversation as resolved.
Show resolved Hide resolved

Then, enroll the device:

$ sudo systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=0+7 /your/boot/device
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think /your/boot/device is confusing. It makes it sound like you should specify your /boot or ESP device here, when actually it's your LUKS block device.

Maybe /your/luks/device is better?

And then also add a follow-up paragraph that explains you can determine which device that is by running sudo cryptsetup status /dev/mapper/luks-* or looking in /etc/crypttab.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

added some steps around finding the proper device, changed my shorthand for the device location