systemd v261 added systemd-pcrlogin@.service, which logind starts on
first login of a user to measure the user record into the 'login'
NvPCR. NixOS does not install the unit, so every first login logs:
systemd-logind: Failed to start user measurement service
'systemd-pcrlogin@1000.service', ignoring: Unit not found.
Install the unit on systems with systemd.tpm2.enable. The unit has ConditionSecurity=measured-os and does nothing elsewhere.
This adds io.systemd.PCRExtend if the system has TPM2
enabled.
Additionally, this requires the system to fullfill
ConditionSecurity=measured-uki.
Change-Id: I3f1046cdc7463f3b6d3205030f7f12ac95e5cd9e
Signed-off-by: Raito Bezarius <masterancpp@gmail.com>
Some upstream systemd units are conditionally installed into the systemd
output, so we must make sure the feature that enables their installation
is enabled on our side prior to trying to use them.
tpm2.target was functionally useless without these services and this
generator. When systemd-cryptsetup-generator creates
systemd-cryptsetup@.service units, they are ordered after
systemd-tpm2-setup-early.service, not tpm2.target. These services are
themselves ordered after tpm2.target.
Note: The systemd-tpm2-setup(-early) services will serve no *function*
under a normal NixOS system at the moment. Because of their
ConditionSecurity=measured-uki, they will always be skipped, unless
you are building an appliance with the system.build.uki feature. Thus,
these are enabled solely for their systemd unit ordering properties.
