You are not logged in.
Hello everyone,
I have a root with LUKS encryption automatically discovered by GPT. After switching to booster-git 0.13.r108.g55ef72a-1 from mkinitcpio as my initramfs generator, systemd-creds fails to obtain my PCR signature:
sudo systemd-creds decrypt \
/var/lib/libvirt/secrets/secrets-encryption-key \
/tmp/libvirt-secret-test
Couldn't find PCR signature file: Host is downBecause of this, libvirtd.service fails to start, because it requires /var/lib/libvirt/secrets/secrets-encryption-key to be decrypted. I have enrolled my TPM as it is explained in booster's man page:
sudo systemd-cryptenroll --tpm2-device=auto \
--tpm2-pcrs=7+15:sha256=0000000000000000000000000000000000000000000000000000000000000000 \
--tpm2-public-key=/etc/systemd/tpm2-pcr-public-key-initrd.pem --tpm2-public-key-pcrs=11 /dev/nvme0n1p2Currently my /etc/kernel/uki.conf looks like so:
# This file is part of systemd.
#
# systemd is free software; you can redistribute it and/or modify it under the
# terms of the GNU Lesser General Public License as published by the Free
# Software Foundation; either version 2.1 of the License, or (at your option)
# any later version.
#
# Ini-style configuration file for ukify(1) which is only effective when
# $KERNEL_INSTALL_LAYOUT or layout= in install.conf is set to uki and
# $KERNEL_INSTALL_UKI_GENERATOR or uki_generator= in install.conf is set to
# ukify, or is unset. $KERNEL_INSTALL_CONF_ROOT may be used to override the
# search path.
#
# See kernel-install(8) for details.
[UKI]
#Initrd=/boot/booster-linux-zen.img
Microcode=/boot/intel-ucode.img
#Splash=
#PCRPKey=
PCRBanks=sha256
SecureBootSigningTool=sbsign
SecureBootPrivateKey=/etc/kernel/secure-boot-private-key.pem
SecureBootCertificate=/etc/kernel/secure-boot-certificate.pem
#SecureBootCertificateDir=
#SecureBootCertificateName=
#SecureBootCertificateValidity=
#SigningEngine=
#SignKernel=
[PCRSignature:all]
PCRPrivateKey=/etc/systemd/tpm2-pcr-private-key.pem
PCRPublicKey=/etc/systemd/tpm2-pcr-public-key.pem
[PCRSignature:initrd]
PCRPrivateKey=/etc/systemd/tpm2-pcr-private-key-initrd.pem
PCRPublicKey=/etc/systemd/tpm2-pcr-public-key-initrd.pem
Phases=enter-initrdCould it be because /run/systemd/tpm2-pcr-signature.json is missing? How do I have this file created? Thank you!
Last edited by retractant0916 (Yesterday 07:52:25)
Offline
What happens if you run this? Did you mean your system doesn't boot, or only that libvirtd.service fails?
> systemd-analyze pcrsThe error "Host is down" is quite strange. However just a reminder that with "-tpm2-pcrs=7+15:sha256=0" the secret on the TPM will not be accessible after boot (as pcr 15 will be filled). Also booster is different from mkinitcpio in that it doesn't use sysytemd in the initramfs but its own components, so that might cause some difference.
EDIT: I just read libvirt, /var/lib/libvirt/secrets/secrets-encryption-key is a secret sealed by libvirt with systemd-cred using default parameters. (So LUKS unlock works, just a file on disk doesn't.)
If that command returns no error, I'll guess the PCR values changed due to the mkinitcpio -> booster switch.
EDIT2: oh I see what you meant with tpm2-pcr-signature.json. You have tpm2-pcr-public-key.pem which systemd-cred encrypt will automatically use (it seems) (I didn't scroll down on the uki.conf...). I've never tried this before but see Example 2 in systemd-measure on how to create it. (Though I don't think mkinitcpio includes anything that automatically generates it)
Last edited by Beemo (2026-09-17 19:32:17)
Offline
What happens if you run this? Did you mean your system doesn't boot, or only that libvirtd.service fails?
> systemd-analyze pcrs
My system boots, but the libvirtd.service fails. Here is the output of systemd-analyze pcrs:
NR NAME SHA256
0 platform-code 9912d8ac9dfc1efbc37cb1269ebc27b224c2407353142ed3904bddb93a022c8f
1 platform-config 905bd5a74bade37a43e1371f3734e56a5eaeb1313b867f8e002177d3ef3b1f84
2 external-code ac758a9401184483f272409a5cd97798677bd3b176f2a3c544488248356a35ff
3 external-config 3d458cfe55cc03ea1f443f1562beec8df51c75e14a9fcf9a7234a13f198e7969
4 boot-loader-code eb6feed69b5cb6fe0c464b04d676582ddc7321e2424f4dc3ed5fe1725f98df4a
5 boot-loader-config 086d505d4c1341198928232ecc329192ef9dc473bf02c3fad903fa53536caa62
6 host-platform 3d458cfe55cc03ea1f443f1562beec8df51c75e14a9fcf9a7234a13f198e7969
7 secure-boot-policy 8def97e11f307c7034e9b3b4991936a62a569529d22b0de9ecaee8df599ea13f
8 - 0000000000000000000000000000000000000000000000000000000000000000
9 kernel-initrd 0c7f0e979dc9b5c964efac4cd04960ca23ecdf0f4fd5e5f5e524df63931b8618
10 ima 0000000000000000000000000000000000000000000000000000000000000000
11 kernel-boot f3db46ec7fc0f53bf5755c726c44553d8cc5201bbf880876121c2b7d9c666467
12 kernel-config 731aa2eb077ed09502c5d2eacf41fa5603331a4cc1cb35fdacf7db16f83877a3
13 sysexts 0000000000000000000000000000000000000000000000000000000000000000
14 shim-policy 0000000000000000000000000000000000000000000000000000000000000000
15 system-identity 61f402692400d41636cd484d2b7289b3b6b9c35b1770549f7ecdaf0dfb74b02b
16 debug 0000000000000000000000000000000000000000000000000000000000000000
17 - ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
18 - ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
19 - ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
20 - ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
21 - ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
22 - ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
23 application-support 0000000000000000000000000000000000000000000000000000000000000000I enrolled my TPM key to only unlock in the enter-initrd phase, as explained in the PCR policies section of wiki page for Trusted Platform Module
EDIT: Not sure if it's pertinent to the issue, but I forgot to mention that if I switch back to mkinitcpio by changing initrd_generator value in /etc/kernel/install.conf, the TPM unlock of the LUKS volume fails and I need to type in the recovery key.
Last edited by retractant0916 (2026-09-17 18:06:05)
Offline
Not sure what's the last version you had but mkinitcpio v42 changes the PCRs. If I read the doc correctly, while 11 is backed by signing on build, 7 & 15 are changed so it won't pass the check.
p.s. The PCR policy is going over my head a bit...
Last edited by Beemo (2026-09-17 18:53:33)
Offline
Ok I found what created the tpm2-pcr-signature.json, it's systemd-stub.
When ".pcrsig" and/or ".pcrpkey" sections are present in a unified kernel image their contents are passed to the booted kernel in an synthetic initrd cpio archive that places them in the /.extra/tpm2-pcr-signature.json and /.extra/tpm2-pcr-public-key.pem files. Typically, a tmpfiles.d(5) line then ensures they are copied into /run/systemd/tpm2-pcr-signature.json and /run/systemd/tpm2-pcr-public-key.pem where they remain accessible even after the system transitions out of the initrd environment into the host file system. Tools such systemd-cryptsetup@.service(8), systemd-cryptenroll(1) and systemd-creds(1) will automatically use files present under these paths to unlock protected resources (encrypted storage or credentials) or bind encryption to booted kernels.
(Though still I'm not sure why it's not unlocking, booster image should also contain the stub?)
Last edited by Beemo (2026-09-17 19:04:31)
Offline
Not sure what's the last version you had but mkinitcpio v42 changes the PCRs. If I read the doc correctly, while 11 is backed by signing on build, 7 & 15 are changed so it won't pass the check.
p.s. The PCR policy is going over my head a bit...
Last version I had was v42, so that explains why I had to input the recovery key, but not why /run/systemd/tpm2-pcr-signature.json is missing.
EDIT: just saw your reply about systemd-stub. So this means I should take it up with booster devs and switch to something else in the meantime?
Last edited by retractant0916 (2026-09-17 19:04:00)
Offline
Not sure, I edited it. I'm not sure which tool adds systemd-stub yet (kernel, ukify, booster?)
EDIT: ukify
Last edited by Beemo (2026-09-17 19:14:19)
Offline
sudo bootctl status reports that systemd-stub is present in the ukify, which is generated by kernel-install.
Offline
Typically, a tmpfiles.d(5) line then ensures they are copied into...
My next guess would be this
Offline
> systemd-tmpfiles --tldr
# /usr/lib/tmpfiles.d/20-systemd-stub.conf
C /run/systemd/stub/profile 0444 root root - /.extra/profile
C /run/systemd/stub/os-release 0444 root root - /.extra/os-release
C /run/systemd/stub/boot-secret 0400 root root - /.extra/boot-secret
C /run/systemd/tpm2-pcr-signature.json 0444 root root - /.extra/tpm2-pcr-signature.json
C /run/systemd/tpm2-pcr-public-key.pem 0444 root root - /.extra/tpm2-pcr-public-key.pem
systemd-tmpfiles is included by mkinitcpio. Ok I'm sure booster doesn't include this (or any systemd).
Last edited by Beemo (2026-09-17 19:30:44)
Offline
I found this in /usr/lib/tmpfiles.d/20-systemd-stub.conf
# This file is part of systemd.
#
# systemd is free software; you can redistribute it and/or modify it
# under the terms of the GNU Lesser General Public License as published by
# the Free Software Foundation; either version 2.1 of the License, or
# (at your option) any later version.
# See tmpfiles.d(5) for details.
# Copy systemd-stub provided metadata such as PCR signature and public key file
# from initrd into /run/, so that it will survive the initrd stage
C /run/systemd/stub/profile 0444 root root - /.extra/profile
C /run/systemd/stub/os-release 0444 root root - /.extra/os-release
C /run/systemd/stub/boot-secret 0400 root root - /.extra/boot-secret
C /run/systemd/tpm2-pcr-signature.json 0444 root root - /.extra/tpm2-pcr-signature.json
C /run/systemd/tpm2-pcr-public-key.pem 0444 root root - /.extra/tpm2-pcr-public-key.pemNeither booster ls, nor lsinitcpio list any of these files.
EDIT: formatting
Last edited by retractant0916 (2026-09-17 19:57:27)
Offline
Okay then, Booster is missing systemd-tmpfiles.service. Should I close this as SOLVED?
Offline
Your call :p
Offline