On Tue, Dec 22, 2020, 12:59 AM Gordon Messmer <gordon.messmer(a)gmail.com
wrote:
https://blog.dowhile0.org/2017/10/18/automatic-luks-volumes-unlocking-usi...
The use of clevis to bind a LUKS volume to a TPM2 device isn't very well
documented, but a few articles and blogs provide working examples for a
single LUKS volume:
"clevis luks bind -d /dev/sda3 tpm2
'{"pcr_ids":"7"}'"
Does anyone know if it's possible to bind two volumes and unlock them
both at boot, using the TPM2 device?
Lennart was working on this a while ago in systemd. I'm not sure how far
along it is. Could git clone it and then:
git log --grep=TPM2
I'm not sure how to do case insensitive with git's grep. I know he was also
working on security key support for sd-homed and possible sd-cryptsetup.
Anyway, this is something Workstation WG has been looking at in particular
for encrypting system root. That way a user entered passphrase isnt needed
to boot. And the user login passphrase unlocks just that user's home.
--
Chris Murphy