systemd: build without TPM2 support - #689
Closed
JanZachmann wants to merge 1 commit into
Closed
Conversation
The TPM2 feature set brings systemd-tpm2-setup, which since the NvPCR addition seals an anchor secret into the TPM on every boot. That seal is dictionary attack protected, so once the TPM's failed-tries counter is exhausted the unit fails, the system state turns degraded, and an update being validated is rolled back although it is fine. None of what the feature offers is used: there are no encrypted volumes and no TPM sealed credentials. The TPM itself keeps working for the identity service and the tpm2 tools, which do not go through systemd. Signed-off-by: Jan Zachmann <50990105+JanZachmann@users.noreply.github.com>
HarryWaschkeit
approved these changes
Aug 21, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Build systemd without its TPM2 feature set (
-Dtpm2=disabled). That dropssystemd-tpm2-setup.serviceand-early, the NvPCR initialization and thesystemd-pcr*units.Reason
systemd-tpm2-setupseals an NvPCR anchor secret into the TPM on every boot. The seal is dictionary attack protected, so it fails while the TPM's failed-tries counter sits atmaxTries: the unit fails, the system state turnsdegraded, and an update under validation is rolled back although the update is fine. The counter climbs on its own, because every reset without an orderlyTPM2_Shutdownadds one and nothing ever resets it.Nothing uses the feature: there are no encrypted volumes, no TPM sealed credentials, and no reference to NvPCRs in this layer. The TPM stays available to the identity service, which links
libtss2directly, and totpm2-tools. Images built before the feature was turned on report-TPM2and ship no such unit.