3️⃣3️⃣ Here's the 33rd post highlighting key new features of the recently published v262 release of systemd. #systemd262 #systemd
For a longer time now systemd has supported the "credentials" concept, that allows passing parameters to systems and services in a secure way, with optional locking to the local TPM. One of the key goals of the design was to make the TPM binding logic "just work". Specifically, not all systems have TPMs, and thus it was key to gracefully degrade: the encryption…
3️⃣5️⃣ Here's the 35th post highlighting key new features of the recently published v262 release of systemd. #systemd262 #systemd
A key concept in systemd's TPM support is that UKIs can carry information about expected PCR measurements (specifically PCR 11), which are signed by a cryptographic key of the vendor. The idea is to use this as one of the protections on disk encryption keys protected by the TPM: only on systems where PCR 11 is in a state for which the OS vendor provided such a…
3️⃣4️⃣ Here's the 34th post highlighting key new features of the recently published v262 release of systemd. #systemd262 #systemd
For a long time systemd has supported rebooting via "kexec" as a mechanism very similar like regular reboots. In v261 the concept became a lot more powerful via support for "LUO", i.e. the ability to pass resources from the current OS cycle to the next, across a kexec reboot.
With v262 we are improving kexec support in more ways: "systemctl kexec"'s kernel…
