Skip to content

Instantly share code, notes, and snippets.

@katrinafyi

katrinafyi/luks-tpm2-dracut-systemd-cryptenroll.md

Last active April 7, 2024 20:37
Show Gist options
  • Save katrinafyi/5742f2a53b56343f46d6e843db2f9af2 to your computer and use it in GitHub Desktop.
Save katrinafyi/5742f2a53b56343f46d6e843db2f9af2 to your computer and use it in GitHub Desktop.
Download ZIP
Setting up TPM2-backed encryption on LUKS with systemd-cryptenroll and dracut.
Raw
luks-tpm2-dracut-systemd-cryptenroll.md

luks-tpm2-dracut-systemd-cryptenroll.md

This documents how to add a TPM2-backed key to an existing LUKS root partition, first done with EndeavourOS in June 2023. In particular, it covers the dracut (instead of mkinitcpio) and systemd-cryptenroll (instead of clevis). Previously, we used clevis but this was slow to act while booting.

  1. Have a LUKS partition using LUKS2. If you're using LUKS1, this can be upgraded with sudo cryptsetup convert --type luks2 /dev/nvme. If you've previously used clevis, this may leave metadata which breaks the upgrade. This can be removed with sudo luksmeta nuke -d /dev/nvme.
  2. Add the tpm2-tss module to dracut by creating /etc/drcaut.conf.d/tpm.conf with the following content: 
    add_dracutmodules+=" tpm2-tss "
  3. Modify the corresponding line in /etc/crypttab by replacing the 3rd column with - and the 4th column with tpm2-device=auto. This should be done before dracut regeneration, as it will affect the PCR registers.
  4. Regenerate the initramfs with 
    sudo dracut -fv --regenerate-all
  5. Reboot the system to obtain the correct PCR measurements. This should still require entering a decryption key.
  6. Add the TPM key with 
    sudo systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=7+9 /dev/nvme
    (existing LUKS slots can be checked with sudo cryptsetup luksDump /dev/nvme.
  7. Reboot to test.

References:

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment