SYSTEMD-PCRPHASE.SERVICE(8) systemd-pcrphase.service systemd-pcrphase.service systemd-pcrphase-sysinit.service systemd-pcrphase-initrd.service systemd-pcrmachine.service systemd-pcrproduct.service systemd-pcrfs-root.service systemd-pcrfs@.service systemd-pcrnvdone.service systemd-pcrextend - (UUID) PCR NvPCR TPM systemd-pcrphase.service systemd-pcrphase-sysinit.service systemd-pcrphase-initrd.service systemd-pcrmachine.service systemd-pcrproduct.service systemd-pcrfs-root.service systemd-pcrfs@.service systemd-pcrnvdone.service /usr/lib/systemd/systemd-pcrextend [STRING] systemd-pcrphase.service systemd-pcrphase-sysinit.service systemd-pcrphase-initrd.service PCR 11 TPM2 . systemd-pcrmachine.service ( machine-id(5)) PCR 15. systemd-pcrproduct.service (UUID) ( SMBIOS Devicetree ...) NvPCR "hardware". systemd-pcrnvdone.service PCR 9 NvPCRs. systemd-pcrfs-root.service systemd-pcrfs@.service ( (UUID) ) PCR 15. systemd-pcrfs-root.service systemd-pcrfs@.service . systemd-stub(7) (UKI). . PCR 11 PCR 11 TPM2 . PCR 11 : 1. "enter-initrd" -- initrd initrd. initrd UKI. ( systemd-pcrphase-initrd.service(8).) 2. "leave-initrd" -- initrd . initrd . ( systemd-pcrphase-sysinit.service(8).) 3. "sysinit" -- ( ) . ( systemd-pcrphase-sysinit.service(8).) 4. "ready" -- ( remote-fs.target) ( systemd-user-sessions.service). . ( systemd-pcrphase-sysinit.service(8).) 5. "shutdown" -- . . ( systemd-pcrphase.service.) 6. "final" -- . . ( systemd-pcrphase-sysinit.service(8).) PCR 11 "enter-initrd" "leave-initrd" "sysinit" "ready" "shutdown" "final". (" "). "enter-initrd:leave-initrd:sysinit:ready" initrd "enter-initrd". initrd (":") . . TPM2 initrd . systemd-measure(1) PCR 11 ( --phase=). systemd-pcrfs-root.service systemd-pcrfs@.service systemd-gpt-auto-generator(8) /var/. systemd-fstab-generator(8) x-systemd.pcrfs /etc/fstab. /usr/lib/systemd/systemd-pcrextend PCR NvPCR : --bank= PCR . PCR . 252. --pcr= PCR . --machine-id --file-system= 15 ( --product-id) 11. --nvpcr=. 255. --nvpcr= NvPCR . NvPCRs PCRs NV TPM. "hardware" "disk-encryption". --product-id "hardware". --pcr=. 259. --tpm2-device= TPM2 . TPM2 ( /dev/tpmrm0). "auto" TPM2 ( ). "list" TPM2 . 252. --graceful TPM2 0 ( ). TPM2 . 253. --early . NvPCR /var/lib/ /run/. ( initrd.) 259. --machine-id PCR 11 PCR 15. 253. --product-id PCR 11 UUID NvPCR "hardware". 259. --file-system= PCR 11 PCR 15. . 253. --event-type= . "help" . --machine-id --product-id --file-system= "phase". 259. -h --help . --version . /run/log/systemd/tpm2-measure.log /run/log/systemd/tpm2-measure.log JSON-SEQ[1] TCG Canonical Event Log Format (CEL-JSON)[2] ( "recnum"). BSD LOCK_EX (flock(2)) . TPM LOCK_SH . 252. /usr/lib/nvpcr/*.nvpcr NvPCRs. 259. systemd(1) systemd-stub(7) systemd-measure(1) systemd-gpt-auto-generator(8) systemd-fstab-generator(8) PCR TPM2 systemd[3] 1. JSON-SEQ https://www.rfc-editor.org/rfc/rfc7464.html 2. TCG (CEL-JSON) https://trustedcomputinggroup.org/resource/canonical-event-log-format/ 3. TPM2 PCR systemd https://systemd.io/TPM2_PCR_MEASUREMENTS 3 . . : . systemd 260.2 SYSTEMD-PCRPHASE.SERVICE(8)