From d487441db6714723f2d29f82349ace2df6b3ff3d Mon Sep 17 00:00:00 2001 From: Guilherme Cardoso Date: Mon, 31 Aug 2026 10:31:42 +0100 Subject: [PATCH 1/3] feat(security): bind TPM2 auto-unlock to PCRs 0+7 --- system_files/shared/usr/bin/luks-tpm2-autounlock | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/system_files/shared/usr/bin/luks-tpm2-autounlock b/system_files/shared/usr/bin/luks-tpm2-autounlock index 6a06473..c9e05ac 100755 --- a/system_files/shared/usr/bin/luks-tpm2-autounlock +++ b/system_files/shared/usr/bin/luks-tpm2-autounlock @@ -40,6 +40,6 @@ case "${EXIT_CODE}" in exit 0 esac -if sudo systemd-cryptenroll --wipe-slot=tpm2 --tpm2-device=auto --tpm2-pcrs='' ${SET_PIN_ARG} "${CRYPT_DISK}" ; then +if sudo systemd-cryptenroll --wipe-slot=tpm2 --tpm2-device=auto --tpm2-pcrs=0+7 ${SET_PIN_ARG} "${CRYPT_DISK}" ; then echo "TPM2 LUKS auto-unlock configured for next reboot." fi From a8cf926a15dc51d4318a3f0b6cdefc142f72e48b Mon Sep 17 00:00:00 2001 From: Guilherme Cardoso Date: Mon, 31 Aug 2026 11:33:46 +0100 Subject: [PATCH 2/3] feat(security): add PCR 14 to TPM2 auto-unlock policy --- system_files/shared/usr/bin/luks-tpm2-autounlock | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/system_files/shared/usr/bin/luks-tpm2-autounlock b/system_files/shared/usr/bin/luks-tpm2-autounlock index c9e05ac..913da96 100755 --- a/system_files/shared/usr/bin/luks-tpm2-autounlock +++ b/system_files/shared/usr/bin/luks-tpm2-autounlock @@ -40,6 +40,6 @@ case "${EXIT_CODE}" in exit 0 esac -if sudo systemd-cryptenroll --wipe-slot=tpm2 --tpm2-device=auto --tpm2-pcrs=0+7 ${SET_PIN_ARG} "${CRYPT_DISK}" ; then +if sudo systemd-cryptenroll --wipe-slot=tpm2 --tpm2-device=auto --tpm2-pcrs=0+7+14 ${SET_PIN_ARG} "${CRYPT_DISK}" ; then echo "TPM2 LUKS auto-unlock configured for next reboot." fi From 2fbaae71617f148897609494bef5ff8c8f6451f7 Mon Sep 17 00:00:00 2001 From: Guilherme Cardoso Date: Mon, 31 Aug 2026 15:17:23 +0100 Subject: [PATCH 3/3] Update system_files/shared/usr/bin/luks-tpm2-autounlock Co-authored-by: renner <80410025+renner0e@users.noreply.github.com> --- system_files/shared/usr/bin/luks-tpm2-autounlock | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/system_files/shared/usr/bin/luks-tpm2-autounlock b/system_files/shared/usr/bin/luks-tpm2-autounlock index 913da96..574ae0f 100755 --- a/system_files/shared/usr/bin/luks-tpm2-autounlock +++ b/system_files/shared/usr/bin/luks-tpm2-autounlock @@ -40,6 +40,6 @@ case "${EXIT_CODE}" in exit 0 esac -if sudo systemd-cryptenroll --wipe-slot=tpm2 --tpm2-device=auto --tpm2-pcrs=0+7+14 ${SET_PIN_ARG} "${CRYPT_DISK}" ; then +if sudo systemd-cryptenroll --wipe-slot=tpm2 --tpm2-device=auto --tpm2-pcrs='0+7+14' ${SET_PIN_ARG} "${CRYPT_DISK}" ; then echo "TPM2 LUKS auto-unlock configured for next reboot." fi