Arch Linux

Beemo

Member

Registered: 2024-12-20

Posts: 125

[SOLVED] mkinitcpio v42 changes PCRs and breaks TPM unlock of LUKS

After an update my LUKS started asking me for the unlock password, with TPM unlock complaining:

TPM policy does not match current system state. Either system has been tampered with or policy out-of-date: Operation not permitted

I narrowed the package down to mkinitcpio using Arch Linux Archive.
After downgrading it, TPM unlock works, systemd-analyze pcrs shows that every PCR is different except 15 (which is filled by systemd after unlock).

What's the reason for the PCR changes?

Last edited by Beemo (Yesterday 12:12:24)

Beemo

Member

Registered: 2024-12-20

Posts: 125

Re: [SOLVED] mkinitcpio v42 changes PCRs and breaks TPM unlock of LUKS

https://gitlab.archlinux.org/archlinux/ … _items/310
https://gitlab.archlinux.org/archlinux/ … quests/475
https://github.com/systemd/systemd/blob … b/NEWS#L69

Last edited by Beemo (Yesterday 13:04:17)