'\" t
.TH "SYSTEMD\-REPORT\-SIGN\-TPM2@\&.SERVICE" "8" "" "systemd 262" "systemd-report-sign-tpm2@.service"
.\" -----------------------------------------------------------------
.\" * Define some portability stuff
.\" -----------------------------------------------------------------
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
.\" http://bugs.debian.org/507673
.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
.ie \n(.g .ds Aq \(aq
.el       .ds Aq '
.\" -----------------------------------------------------------------
.\" * set default formatting
.\" -----------------------------------------------------------------
.\" disable hyphenation
.nh
.\" disable justification (adjust text to left margin only)
.ad l
.\" -----------------------------------------------------------------
.\" * MAIN CONTENT STARTS HERE *
.\" -----------------------------------------------------------------
.SH "NAME"
systemd-report-sign-tpm2@.service, systemd-report-sign-tpm2.socket, systemd-report-sign-tpm2 \- Sign system reports with a set of signed TPM2 attestations
.SH "SYNOPSIS"
.PP
systemd\-report\-sign\-tpm2@\&.service
.PP
systemd\-report\-sign\-tpm2\&.socket
.PP
/usr/lib/systemd/systemd\-report\-sign\-tpm2
.SH "DESCRIPTION"
.PP
\fBsystemd\-report\-sign\-tpm2@\&.service\fR
is a system service that signs system reports generated by
\fBsystemd-report\fR(1)\&. It is a signing backend for the
\fB\-\-sign=\fR
logic of that tool: it implements the
\fBio\&.systemd\&.Report\&.Signer\&.Sign()\fR
Varlink method and is reached via a socket linked into the
/run/systemd/report\&.sign/
directory, named
tpm2\&.
.PP
The service is socket\-activated (one instance per connection) via
systemd\-report\-sign\-tpm2\&.socket\&. Rather than returning a single signature, it uses a TPM2 device to generate a set of signed attestations that also bind the report digest passed to it, together providing a verifier with evidence about the state of the system that produced the report\&.
.PP
The returned report consists of several signed components, each carrying a JSON encoded attestation structure and its corresponding signature\&. The signature is provided as a JSON encoded
\fBTPMT_SIGNATURE\fR
structure and in PEM encoded form\&. The signed component types are:
.sp
.RS 4
.ie n \{\
\h'-04'\(bu\h'+03'\c
.\}
.el \{\
.sp -1
.IP \(bu 2.3
.\}
A PCR quote, generated with
\fBTPM2_Quote\fR
.RE
.sp
.RS 4
.ie n \{\
\h'-04'\(bu\h'+03'\c
.\}
.el \{\
.sp -1
.IP \(bu 2.3
.\}
One attestation per NvPCR, generated with
\fBTPM2_NV_Certify\fR\&. Each component also includes the readable name of the NvPCR, the NV index public area (as a JSON encoded
\fBTPMS_NV_PUBLIC\fR
structure), and a JSON blob of authenticated data (the NvPCR name and priority) that is digested and supplied as the qualifying data to the certify command\&.
.RE
.sp
.RS 4
.ie n \{\
\h'-04'\(bu\h'+03'\c
.\}
.el \{\
.sp -1
.IP \(bu 2.3
.\}
An audit session attestation, generated with
\fBTPM2_GetSessionAuditDigest\fR\&. This is always the last component\&. The report digest passed in via Varlink is supplied as its qualifying data\&.
.RE
.PP
The report additionally includes the measurement event log, and the public area of the signing key\&. The public area is provided as a JSON encoded
\fBTPMT_PUBLIC\fR
structure, and in PEM encoded form\&.
.PP
The preceding components are all executed under the audit session, and the report is only generated if that session remains exclusive throughout\&. Because the audit session attestation records whether the session was still exclusive when it was signed, this provides evidence to a verifier that the report is a single, consistent snapshot of the system, with no other TPM commands interleaved while it was generated\&.
.PP
The set of attested PCRs and NvPCRs is currently fixed\&. It covers all firmware PCRs except PCR 6, all other S\-RTM PCRs except the IMA PCR (which is not useful without the IMA log), and all defined NvPCRs\&.
.SH "SIGNING KEY"
.PP
The attestation signing key is stored as a JSON file named
default\&.key
in
/var/lib/systemd/report\&.sign\&.tpm2/\&. Three kinds of key are supported: an ordinary object protected by an existing persistent object such as the SRK or EK, a persistent object, and a primary object that is recreated from a template on each use\&. In all cases the key must be a restricted signing key\&. If no key exists, an ordinary key is generated automatically on first use\&.
.PP
For ordinary and primary keys, the loaded object context is cached in the service\*(Aqs runtime directory as
/run/systemd/report\&.sign\&.tpm2/default\&.context
and reused on subsequent invocations, avoiding a repeated
\fBTPM2_Load\fR
(which requires authorization with the parent key) or primary key recreation\&.
.PP
The key may optionally have an associated
\fIvoucher\fR, stored alongside it as
default\&.voucher\&. This is an opaque credential \(em for example one issued by a CA during onboarding \(em that is attached to the signed report and presented to a verifier as proof that the attestation key is authentic\&. It is deliberately not required to be any particular format (such as an X\&.509 certificate)\&.
.SH "SEE ALSO"
.PP
\fBsystemd\fR(1), \fBsystemd-report\fR(1)