From 340d979af338c43756925d265c74cca62412ab59 Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Wed, 27 Sep 2023 12:08:41 +0200 Subject: [PATCH] condition: add ConditionSecurity=measured-uki We have various services that should only run in a measured UKI environment. Let's add an explicit high-level check for that. --- man/systemd.unit.xml | 66 ++++++++++++++++++++++++++++++++++++++---- src/shared/condition.c | 3 ++ 2 files changed, 64 insertions(+), 5 deletions(-) diff --git a/man/systemd.unit.xml b/man/systemd.unit.xml index ae470ee96e8..fa867dba1ac 100644 --- a/man/systemd.unit.xml +++ b/man/systemd.unit.xml @@ -1479,11 +1479,67 @@ ConditionSecurity= ConditionSecurity= may be used to check whether the given - security technology is enabled on the system. Currently, the recognized values are - selinux, apparmor, tomoyo, - ima, smack, audit, - uefi-secureboot, tpm2 and cvm. - The test may be negated by prepending an exclamation mark. + security technology is enabled on the system. Currently, the following values are recognized: + + + Recognized security technologies + + + + + + + + Value + Description + + + + + selinux + SELinux MAC + + + apparmor + AppArmor MAC + + + tomoyo + Tomoyo MAC + + + smack + SMACK MAC + + + ima + Integrity Measurement Architecture (IMA) + + + audit + Linux Audit Framework + + + uefi-secureboot + UEFI SecureBoot + + + tpm2 + Trusted Platform Module 2.0 (TPM2) + + + cvm + Confidential virtual machine (SEV/TDX) + + + measured-uki + Unified Kernel Image with PCR 11 Measurements, as per systemd-stub7. + + + +
+ + The test may be negated by prepending an exclamation mark. diff --git a/src/shared/condition.c b/src/shared/condition.c index 06fcd71be58..d3446e8a9da 100644 --- a/src/shared/condition.c +++ b/src/shared/condition.c @@ -28,6 +28,7 @@ #include "cpu-set-util.h" #include "creds-util.h" #include "efi-api.h" +#include "efi-loader.h" #include "env-file.h" #include "env-util.h" #include "extract-word.h" @@ -692,6 +693,8 @@ static int condition_test_security(Condition *c, char **env) { return has_tpm2(); if (streq(c->parameter, "cvm")) return detect_confidential_virtualization() > 0; + if (streq(c->parameter, "measured-uki")) + return efi_measured_uki(LOG_DEBUG); return false; }