diff options
| author | Thomas Strobel <ts468@cam.ac.uk> | 2015-10-05 13:45:20 +0200 |
|---|---|---|
| committer | Thomas Strobel <ts468@cam.ac.uk> | 2015-10-06 20:12:39 +0200 |
| commit | 7a8980193d94a15bf4d7267d846e5b69c61fa413 (patch) | |
| tree | c565ac3b34dc64862a6a7fd1e6a0212770a39831 /nixos | |
| parent | 5b800ea05e6a3a28904aaceaa789342cd6654820 (diff) | |
| download | nixpkgs-7a8980193d94a15bf4d7267d846e5b69c61fa413.tar nixpkgs-7a8980193d94a15bf4d7267d846e5b69c61fa413.tar.gz nixpkgs-7a8980193d94a15bf4d7267d846e5b69c61fa413.tar.bz2 nixpkgs-7a8980193d94a15bf4d7267d846e5b69c61fa413.tar.lz nixpkgs-7a8980193d94a15bf4d7267d846e5b69c61fa413.tar.xz nixpkgs-7a8980193d94a15bf4d7267d846e5b69c61fa413.tar.zst nixpkgs-7a8980193d94a15bf4d7267d846e5b69c61fa413.zip | |
nixos grub: trustedBoot: introduce safety check that TPM is available
Diffstat (limited to 'nixos')
| -rw-r--r-- | nixos/modules/system/boot/loader/grub/grub.nix | 15 |
1 files changed, 13 insertions, 2 deletions
diff --git a/nixos/modules/system/boot/loader/grub/grub.nix b/nixos/modules/system/boot/loader/grub/grub.nix index 0b349749244..ce3efc3cd7c 100644 --- a/nixos/modules/system/boot/loader/grub/grub.nix +++ b/nixos/modules/system/boot/loader/grub/grub.nix @@ -378,6 +378,17 @@ in ''; }; + systemHasTPM = mkOption { + default = ""; + example = "YES_TPM_is_activated"; + type = types.string; + description = '' + Assertion that the target system has an activated TPM. It is a safety + check before allowing the activation of 'enableTrustedBoot'. TrustedBoot + WILL FAIL TO BOOT YOUR SYSTEM if no TPM is available. + ''; + }; + }; }; @@ -453,8 +464,8 @@ in message = "Trusted GRUB does not have ZFS support"; } { - assertion = !cfg.enableTrustedBoot; - message = "Trusted GRUB can break your system. Remove assertion if you want to test trustedGRUB nevertheless."; + assertion = !cfg.enableTrustedBoot || cfg.systemHasTPM == "YES_TPM_is_activated"; + message = "Trusted GRUB can break the system! Confirm that the system has an activated TPM by setting 'systemHasTPM'."; } ] ++ flip concatMap cfg.mirroredBoots (args: [ { |