systemd-stub(7) — Linux manual page

NAME | SYNOPSIS | DESCRIPTION | COMPANION FILES | TPM PCR NOTES | EFI VARIABLES | INITRD RESOURCES | SMBIOS TYPE 11 STRINGS | ASSEMBLING KERNEL IMAGES | SEE ALSO | NOTES | COLOPHON

SYSTEMD-STUB(7)               systemd-stub               SYSTEMD-STUB(7)

NAME         top

       systemd-stub, sd-stub, linuxx64.efi.stub, linuxia32.efi.stub,
       linuxaa64.efi.stub - A simple UEFI kernel boot stub

SYNOPSIS         top

           /usr/lib/systemd/boot/efi/linuxx64.efi.stub
           /usr/lib/systemd/boot/efi/linuxia32.efi.stub
           /usr/lib/systemd/boot/efi/linuxaa64.efi.stub
           ESP/.../foo.efi.extra.d/*.addon.efi
           ESP/.../foo.efi.extra.d/*.cred
           ESP/.../foo.efi.extra.d/*.raw
           ESP/.../foo.efi.extra.d/*.sysext.raw
           ESP/.../foo.efi.extra.d/*.confext.raw
           ESP/loader/addons/*.addon.efi
           ESP/loader/credentials/*.cred

DESCRIPTION         top

       systemd-stub (stored in per-architecture files linuxx64.efi.stub,
       linuxia32.efi.stub, linuxaa64.efi.stub on disk) is a simple UEFI
       boot stub. An UEFI boot stub is attached to a Linux kernel binary
       image, and is a piece of code that runs in the UEFI firmware
       environment before transitioning into the Linux kernel
       environment. The UEFI boot stub ensures a Linux kernel is
       executable as regular UEFI binary, and is able to do various
       preparations before switching the system into the Linux world.

       The UEFI boot stub looks for various resources for the kernel
       invocation inside the UEFI PE binary itself. This allows
       combining various resources inside a single PE binary image
       (usually called "Unified Kernel Image", or "UKI" for short),
       which may then be signed via UEFI SecureBoot as a whole, covering
       all individual resources at once. Specifically it may include:

       •   A ".linux" section with the ELF Linux kernel image.

       •   An ".osrel" section with OS release information, i.e. the
           contents of the os-release(5) file of the OS the kernel
           belongs to.

       •   A ".cmdline" section with the kernel command line to pass to
           the invoked kernel.

       •   An ".initrd" section with the initrd.

       •   A ".ucode" section with an initrd containing microcode, to be
           handed to the kernel before any other initrd. This initrd
           must not be compressed.

       •   A ".splash" section with an image (in the Windows .BMP
           format) to show on screen before invoking the kernel.

       •   A ".dtb" section with a compiled binary DeviceTree.

       •   A ".uname" section with the kernel version information, i.e.
           the output of uname -r for the kernel included in the
           ".linux" section.

       •   An ".sbat" section with SBAT[1] revocation metadata.

       •   A ".pcrsig" section with a set of cryptographic signatures
           for the expected TPM2 PCR values after the kernel has been
           booted, in JSON format. This is useful for implementing TPM2
           policies that bind disk encryption and similar to kernels
           that are signed by a specific key.

       •   A ".pcrpkey" section with a public key in the PEM format
           matching the signature data in the ".pcrsig" section.

       If UEFI SecureBoot is enabled and the ".cmdline" section is
       present in the executed image, any attempts to override the
       kernel command line by passing one as invocation parameters to
       the EFI binary are ignored. Thus, in order to allow overriding
       the kernel command line, either disable UEFI SecureBoot, or don't
       include a kernel command line PE section in the kernel image
       file. If a command line is accepted via EFI invocation parameters
       to the EFI binary it is measured into TPM PCR 12 (if a TPM is
       present).

       If a DeviceTree is embedded in the ".dtb" section, it replaces an
       existing DeviceTree in the corresponding EFI configuration table.
       systemd-stub will ask the firmware via the
       "EFI_DT_FIXUP_PROTOCOL" for hardware specific fixups to the
       DeviceTree.

       The contents of eight of these nine sections are measured into
       TPM PCR 11. It is otherwise not used and thus the result can be
       pre-calculated without too much effort. The ".pcrsig" section is
       not included in this PCR measurement, since it is supposed to
       contain signatures for the output of the measurement operation,
       and thus cannot also be input to it.

       When ".pcrsig" and/or ".pcrpkey" sections are present in a
       unified kernel image their contents are passed to the booted
       kernel in an synthetic initrd cpio archive that places them in
       the /.extra/tpm2-pcr-signature.json and
       /.extra/tpm2-pcr-public-key.pem files. Typically, a tmpfiles.d(5)
       line then ensures they are copied into
       /run/systemd/tpm2-pcr-signature.json and
       /run/systemd/tpm2-pcr-public-key.pem where they remain accessible
       even after the system transitions out of the initrd environment
       into the host file system. Tools such
       [email protected](8), systemd-cryptenroll(1) and
       systemd-creds(1) will automatically use files present under these
       paths to unlock protected resources (encrypted storage or
       credentials) or bind encryption to booted kernels.

       For further details about the UKI concept, see the UKI
       specification[2].

COMPANION FILES         top

       The systemd-stub UEFI boot stub automatically collects three
       types of auxiliary companion files optionally placed in drop-in
       directories on the same partition as the EFI binary, dynamically
       generates cpio initrd archives from them, and passes them to the
       kernel. Specifically:

       •   For a kernel binary called foo.efi, it will look for files
           with the .cred suffix in a directory named foo.efi.extra.d/
           next to it. If the kernel binary uses a counter for the
           purpose of Automatic Boot Assessment[3], this counter will be
           ignored. For example, foo+3-0.efi will look in directory
           foo.efi.extra.d/. A cpio archive is generated from all files
           found that way, placing them in the /.extra/credentials/
           directory of the initrd file hierarchy. The main initrd may
           then access them in this directory. This is supposed to be
           used to store auxiliary, encrypted, authenticated credentials
           for use with LoadCredentialEncrypted= in the UEFI System
           Partition. See systemd.exec(5) and systemd-creds(1) for
           details on encrypted credentials. The generated cpio archive
           is measured into TPM PCR 12 (if a TPM is present).

       •   Similarly, files foo.efi.extra.d/*.sysext.raw are packed up
           in a cpio archive and placed in the /.extra/sysext/ directory
           in the initrd file hierarchy. This is supposed to be used to
           pass additional system extension images to the initrd. See
           systemd-sysext(8) for details on system extension images. The
           generated cpio archive containing these system extension
           images is measured into TPM PCR 13 (if a TPM is present).

       •   Similarly, files foo.efi.extra.d/*.confext.raw are packed up
           in a cpio archive and placed in the /.extra/confext/
           directory in the initrd file hierarchy. This is supposed to
           be used to pass additional configuration extension images to
           the initrd. See systemd-confext(8) for details on
           configuration extension images. The generated cpio archive
           containing these system extension images is measured into TPM
           PCR 12 (if a TPM is present).

       •   Similarly, files foo.efi.extra.d/*.addon.efi are loaded and
           verified as PE binaries, and a ".cmdline" section is parsed
           from them. Addons are supposed to be used to pass additional
           kernel command line parameters or Devicetree blobs,
           regardless of the kernel image being booted, for example to
           allow platform vendors to ship platform-specific
           configuration.

           In case Secure Boot is enabled, these files will be validated
           using keys in UEFI DB, Shim's DB or Shim's MOK, and will be
           rejected otherwise. Additionally, if both the addon and the
           UKI contain a ".uname" section, the addon will be rejected if
           they do not match exactly. It is recommended to always add a
           ".sbat" section to all signed addons, so that they may be
           revoked with a SBAT policy update, without requiring
           blocklisting via DBX/MOKX. The ukify(1) tool will add a SBAT
           policy by default if none is passed when building addons. For
           more information on SBAT see Shim documentation[1].

           Addon files are sorted, loaded, and measured into TPM PCR 12
           (if a TPM is present) and appended to the kernel command
           line. UKI command line options are listed first, then options
           from addons in /loader/addons/*.addon.efi, and finally
           UKI-specific addons. Device tree blobs are loaded and
           measured following the same algorithm. Addons are always
           loaded in the same order based on the filename, so that,
           given the same set of addons, the same set of measurements
           can be expected in PCR12. However, note that the filename is
           not protected by the PE signature, and as such an attacker
           with write access to the ESP could potentially rename these
           files to change the order in which they are loaded, in a way
           that could alter the functionality of the kernel, as some
           options might be order-dependent. If you sign such addons,
           you should pay attention to the PCR12 values and make use of
           an attestation service so that improper use of your signed
           addons can be detected and dealt with using one of the
           aforementioned revocation mechanisms.

       •   Files /loader/credentials/*.cred are packed up in a cpio
           archive and placed in the /.extra/global_credentials/
           directory of the initrd file hierarchy. This is supposed to
           be used to pass additional credentials to the initrd,
           regardless of the kernel being booted. The generated cpio
           archive is measured into TPM PCR 12 (if a TPM is present).

       •   Additionally, files /loader/addons/*.addon.efi are loaded and
           verified as PE binaries, and ".cmdline" and/or ".dtb"
           sections are parsed from them. This is supposed to be used to
           pass additional command line parameters or Devicetree blobs
           to the kernel, regardless of the kernel being booted.

       These mechanisms may be used to parameterize and extend trusted
       (i.e. signed), immutable initrd images in a reasonably safe way:
       all data they contain is measured into TPM PCRs. On access they
       should be further validated: in case of the credentials case by
       encrypting/authenticating them via TPM, as exposed by
       systemd-creds encrypt -T (see systemd-creds(1) for details); in
       case of the system extension images by using signed Verity
       images.

TPM PCR NOTES         top

       Note that when a unified kernel using systemd-stub is invoked the
       firmware will measure it as a whole to TPM PCR 4, covering all
       embedded resources, such as the stub code itself, the core
       kernel, the embedded initrd and kernel command line (see above
       for a full list).

       Also note that the Linux kernel will measure all initrds it
       receives into TPM PCR 9. This means every type of initrd will be
       measured two or three times: the initrds embedded in the kernel
       image will be measured to PCR 4, PCR 9 and PCR 11; the initrd
       synthesized from credentials (and the one synthesized from
       configuration extensions) will be measured to both PCR 9 and PCR
       12; the initrd synthesized from system extensions will be
       measured to both PCR 4 and PCR 9. Let's summarize the OS
       resources and the PCRs they are measured to:

       Table 1. OS Resource PCR Summary
       ┌──────────────────────────┬─────────────────┐
       │ OS Resource              Measurement PCR │
       ├──────────────────────────┼─────────────────┤
       │ systemd-stub code (the   │ 4               │
       │ entry point of the       │                 │
       │ unified PE binary)       │                 │
       ├──────────────────────────┼─────────────────┤
       │ Core kernel code         │ 4 + 11          │
       │ (embedded in unified PE  │                 │
       │ binary)                  │                 │
       ├──────────────────────────┼─────────────────┤
       │ OS release information   │ 4 + 11          │
       │ (embedded in the unified │                 │
       │ PE binary)               │                 │
       ├──────────────────────────┼─────────────────┤
       │ Main initrd (embedded in │ 4 + 9 + 11      │
       │ unified PE binary)       │                 │
       ├──────────────────────────┼─────────────────┤
       │ Microcode initrd         │ 4 + 9 + 11      │
       │ (embedded in unified PE  │                 │
       │ binary)                  │                 │
       ├──────────────────────────┼─────────────────┤
       │ Default kernel command   │ 4 + 11          │
       │ line (embedded in        │                 │
       │ unified PE binary)       │                 │
       ├──────────────────────────┼─────────────────┤
       │ Overridden kernel        │ 12              │
       │ command line             │                 │
       ├──────────────────────────┼─────────────────┤
       │ Boot splash (embedded in │ 4 + 11          │
       │ the unified PE binary)   │                 │
       ├──────────────────────────┼─────────────────┤
       │ TPM2 PCR signature JSON  │ 4 + 9           │
       │ (embedded in unified PE  │                 │
       │ binary, synthesized into │                 │
       │ initrd)                  │                 │
       ├──────────────────────────┼─────────────────┤
       │ TPM2 PCR PEM public key  │ 4 + 9 + 11      │
       │ (embedded in unified PE  │                 │
       │ binary, synthesized into │                 │
       │ initrd)                  │                 │
       ├──────────────────────────┼─────────────────┤
       │ Credentials (synthesized │ 9 + 12          │
       │ initrd from companion    │                 │
       │ files)                   │                 │
       ├──────────────────────────┼─────────────────┤
       │ System Extensions        │ 9 + 13          │
       │ (synthesized initrd from │                 │
       │ companion files)         │                 │
       ├──────────────────────────┼─────────────────┤
       │ Configuration Extensions │ 9 + 12          │
       │ (synthesized initrd from │                 │
       │ companion files)         │                 │
       └──────────────────────────┴─────────────────┘

EFI VARIABLES         top

       The following EFI variables are defined, set and read by
       systemd-stub, under the vendor UUID
       "4a67b082-0a4c-41cf-b6c7-440b29bb8c4f", for communication between
       the boot stub and the OS:

       LoaderDevicePartUUID
           Contains the partition UUID of the EFI System Partition the
           EFI image was run from.  systemd-gpt-auto-generator(8) uses
           this information to automatically find the disk booted from,
           in order to discover various other partitions on the same
           disk automatically.

           Added in version 250.

       LoaderFirmwareInfo, LoaderFirmwareType
           Brief firmware information. Use bootctl(1) to view this data.

           Added in version 250.

       LoaderImageIdentifier
           The path of EFI executable, relative to the EFI System
           Partition's root directory. Use bootctl(1) to view this data.

           Added in version 250.

       StubInfo
           Brief stub information. Use bootctl(1) to view this data.

           Added in version 250.

       StubPcrKernelImage
           The PCR register index the kernel image, initrd image, boot
           splash, devicetree database, and the embedded command line
           are measured into, formatted as decimal ASCII string (e.g.
           "11"). This variable is set if a measurement was successfully
           completed, and remains unset otherwise.

           Added in version 252.

       StubPcrKernelParameters
           The PCR register index the kernel command line and
           credentials are measured into, formatted as decimal ASCII
           string (e.g.  "12"). This variable is set if a measurement
           was successfully completed, and remains unset otherwise.

           Added in version 252.

       StubPcrInitRDSysExts
           The PCR register index the system extensions for the initrd,
           which are picked up from the file system the kernel image is
           located on. Formatted as decimal ASCII string (e.g.  "13").
           This variable is set if a measurement was successfully
           completed, and remains unset otherwise.

           Added in version 252.

       StubPcrInitRDConfExts
           The PCR register index the configuration extensions for the
           initrd, which are picked up from the file system the kernel
           image is located on. Formatted as decimal ASCII string (e.g.
           "12"). This variable is set if a measurement was successfully
           completed, and remains unset otherwise.

           Added in version 255.

       Note that some of the variables above may also be set by the boot
       loader. The stub will only set them if they aren't set already.
       Some of these variables are defined by the Boot Loader
       Interface[4].

INITRD RESOURCES         top

       The following resources are passed as initrd cpio archives to the
       booted kernel, and thus make up the initial file system hierarchy
       in the initrd execution environment:

       /
           The main initrd from the ".initrd" PE section of the unified
           kernel image.

           Added in version 252.

       /.extra/credentials/*.cred
           Credential files (suffix ".cred") that are placed next to the
           unified kernel image (as described above) are copied into the
           /.extra/credentials/ directory in the initrd execution
           environment.

           Added in version 252.

       /.extra/global_credentials/*.cred
           Similarly, credential files in the /loader/credentials/
           directory in the file system the unified kernel image is
           placed in are copied into the /.extra/global_credentials/
           directory in the initrd execution environment.

           Added in version 252.

       /.extra/sysext/*.sysext.raw
           System extension image files (suffix ".sysext.raw") that are
           placed next to the unified kernel image (as described above)
           are copied into the /.extra/sysext/ directory in the initrd
           execution environment.

           Added in version 252.

       /.extra/confext/*.confext.raw
           Configuration extension image files (suffix ".confext.raw")
           that are placed next to the unified kernel image (as
           described above) are copied into the /.extra/confext/
           directory in the initrd execution environment.

           Added in version 255.

       /.extra/tpm2-pcr-signature.json
           The TPM2 PCR signature JSON object included in the ".pcrsig"
           PE section of the unified kernel image is copied into the
           /.extra/tpm2-pcr-signature.json file in the initrd execution
           environment.

           Added in version 252.

       /.extra/tpm2-pcr-pkey.pem
           The PEM public key included in the ".pcrpkey" PE section of
           the unified kernel image is copied into the
           /.extra/tpm2-pcr-public-key.pem file in the initrd execution
           environment.

           Added in version 252.

       Note that all these files are located in the "tmpfs" file system
       the kernel sets up for the initrd file hierarchy and are thus
       lost when the system transitions from the initrd execution
       environment into the host file system. If these resources shall
       be kept around over this transition they need to be copied to a
       place that survives the transition first, for example via a
       suitable tmpfiles.d(5) line. By default, this is done for the
       TPM2 PCR signature and public key files.

SMBIOS TYPE 11 STRINGS         top

       systemd-stub can be configured using SMBIOS Type 11 strings.
       Applicable strings consist of a name, followed by "=", followed
       by the value. Unless systemd-stub detects it is running inside a
       confidential computing environment, systemd-stub will search the
       table for a string with a specific name, and if found, use its
       value. The following strings are read:

       io.systemd.stub.kernel-cmdline-extra
           If set, the value of this string is added to the list of
           kernel command line arguments that are measured in PCR12 and
           passed to the kernel.

           Added in version 254.

ASSEMBLING KERNEL IMAGES         top

       In order to assemble a bootable Unified Kernel Image from various
       components as described above, use ukify(1).

SEE ALSO         top

       systemd-boot(7), systemd.exec(5), systemd-creds(1),
       systemd-sysext(8), Boot Loader Specification[5], Boot Loader
       Interface[4], ukify(1), systemd-measure(1), TPM2 PCR Measurements
       Made by systemd[6]

NOTES         top

        1. SBAT
           https://github.com/rhboot/shim/blob/main/SBAT.md

        2. UKI specification
           https://uapi-group.org/specifications/specs/unified_kernel_image/

        3. Automatic Boot Assessment
           https://systemd.io/AUTOMATIC_BOOT_ASSESSMENT

        4. Boot Loader Interface
           https://systemd.io/BOOT_LOADER_INTERFACE

        5. Boot Loader Specification
           https://uapi-group.org/specifications/specs/boot_loader_specification

        6. TPM2 PCR Measurements Made by systemd
           https://systemd.io/TPM2_PCR_MEASUREMENTS

COLOPHON         top

       This page is part of the systemd (systemd system and service
       manager) project.  Information about the project can be found at
       ⟨http://www.freedesktop.org/wiki/Software/systemd⟩.  If you have
       a bug report for this manual page, see
       ⟨http://www.freedesktop.org/wiki/Software/systemd/#bugreports⟩.
       This page was obtained from the project's upstream Git repository
       ⟨https://github.com/systemd/systemd.git⟩ on 2024-06-14.  (At that
       time, the date of the most recent commit that was found in the
       repository was 2024-06-13.)  If you discover any rendering
       problems in this HTML version of the page, or you believe there
       is a better or more up-to-date source for the page, or you have
       corrections or improvements to the information in this COLOPHON
       (which is not part of the original manual page), send a mail to
       [email protected]

systemd 257~devel                                        SYSTEMD-STUB(7)

Pages that refer to this page: systemd(1)systemd-cryptenroll(1)systemd-measure(1)ukify(1)systemd.exec(5)systemd.unit(5)systemd-boot(7)systemd.directives(7)systemd.index(7)systemd-boot-random-seed.service(8)systemd-gpt-auto-generator(8)systemd-pcrlock(8)systemd-pcrphase.service(8)systemd-random-seed.service(8)systemd-sysext(8)