🐧 Disable pcrlock for all systemd distros (#2778)

kairos-io · Aug 1, 2024 · ca9d256 · ca9d256
1 parent ada14c8
commit ca9d256
Show file tree

Hide file tree

Showing 6 changed files with 24 additions and 0 deletions.
diff --git a/images/Dockerfile.kairos b/images/Dockerfile.kairos
@@ -109,7 +109,11 @@ RUN rm /etc/machine-id || true
 RUN rm /var/lib/dbus/machine-id || true
 RUN rm /etc/hostname || true
 
+# Disable the make-policy service that its on by default on some systemd versions
+# it creates a pcrlock.json policy that conflicts with our mesurements when trying to enroll it
 RUN if [ "$(which-init.sh)" = "systemd" ]; then \
+      systemctl disable systemd-pcrlock-make-policy || true; \
+      systemctl mask systemd-pcrlock-make-policy || true; \
       journalctl --vacuum-size=1K || true; \
     fi
 

diff --git a/images/Dockerfile.kairos-alpine b/images/Dockerfile.kairos-alpine
@@ -260,7 +260,11 @@ RUN rm /etc/machine-id || true
 RUN rm /var/lib/dbus/machine-id || true
 RUN rm /etc/hostname || true
 
+# Disable the make-policy service that its on by default on some systemd versions
+# it creates a pcrlock.json policy that conflicts with our mesurements when trying to enroll it
 RUN if [ "$(which-init.sh)" = "systemd" ]; then \
+      systemctl disable systemd-pcrlock-make-policy || true; \
+      systemctl mask systemd-pcrlock-make-policy || true; \
       journalctl --vacuum-size=1K || true; \
     fi
 

diff --git a/images/Dockerfile.kairos-debian b/images/Dockerfile.kairos-debian
@@ -273,7 +273,11 @@ RUN rm /etc/machine-id || true
 RUN rm /var/lib/dbus/machine-id || true
 RUN rm /etc/hostname || true
 
+# Disable the make-policy service that its on by default on some systemd versions
+# it creates a pcrlock.json policy that conflicts with our mesurements when trying to enroll it
 RUN if [ "$(which-init.sh)" = "systemd" ]; then \
+      systemctl disable systemd-pcrlock-make-policy || true; \
+      systemctl mask systemd-pcrlock-make-policy || true; \
       journalctl --vacuum-size=1K || true; \
     fi
 

diff --git a/images/Dockerfile.kairos-opensuse b/images/Dockerfile.kairos-opensuse
@@ -269,7 +269,11 @@ RUN rm /etc/machine-id || true
 RUN rm /var/lib/dbus/machine-id || true
 RUN rm /etc/hostname || true
 
+# Disable the make-policy service that its on by default on some systemd versions
+# it creates a pcrlock.json policy that conflicts with our mesurements when trying to enroll it
 RUN if [ "$(which-init.sh)" = "systemd" ]; then \
+      systemctl disable systemd-pcrlock-make-policy || true; \
+      systemctl mask systemd-pcrlock-make-policy || true; \
       journalctl --vacuum-size=1K || true; \
     fi
 

diff --git a/images/Dockerfile.kairos-rhel b/images/Dockerfile.kairos-rhel
@@ -208,7 +208,11 @@ RUN rm /etc/machine-id || true
 RUN rm /var/lib/dbus/machine-id || true
 RUN rm /etc/hostname || true
 
+# Disable the make-policy service that its on by default on some systemd versions
+# it creates a pcrlock.json policy that conflicts with our mesurements when trying to enroll it
 RUN if [ "$(which-init.sh)" = "systemd" ]; then \
+      systemctl disable systemd-pcrlock-make-policy || true; \
+      systemctl mask systemd-pcrlock-make-policy || true; \
       journalctl --vacuum-size=1K || true; \
     fi
 

diff --git a/images/Dockerfile.kairos-ubuntu b/images/Dockerfile.kairos-ubuntu
@@ -474,7 +474,11 @@ RUN rm /etc/machine-id || true
 RUN rm /var/lib/dbus/machine-id || true
 RUN rm /etc/hostname || true
 
+# Disable the make-policy service that its on by default on some systemd versions
+# it creates a pcrlock.json policy that conflicts with our mesurements when trying to enroll it
 RUN if [ "$(which-init.sh)" = "systemd" ]; then \
+      systemctl disable systemd-pcrlock-make-policy || true; \
+      systemctl mask systemd-pcrlock-make-policy || true; \
       journalctl --vacuum-size=1K || true; \
     fi