summarylogtreecommitdiffstats
path: root/initcpio_install_tpm2-totp
diff options
context:
space:
mode:
Diffstat (limited to 'initcpio_install_tpm2-totp')
-rw-r--r--initcpio_install_tpm2-totp55
1 files changed, 0 insertions, 55 deletions
diff --git a/initcpio_install_tpm2-totp b/initcpio_install_tpm2-totp
deleted file mode 100644
index eb22958104d4..000000000000
--- a/initcpio_install_tpm2-totp
+++ /dev/null
@@ -1,55 +0,0 @@
-#!/bin/bash
-
-build() {
- local mod
-
- if [[ $TPM_MODULES ]]; then
- for mod in $TPM_MODULES; do
- add_module "$mod"
- done
- else
- add_all_modules /tpm/
- fi
-
- add_binary tpm2-totp
-
- # Force usage of device TCTI and suppress warnings issued by tpm2-tss
- # when trying to load other TCTI libraries
- add_file /usr/lib/libtss2-tcti-device.so /usr/lib/libtss2-tcti-default.so
-
- add_runscript
-}
-
-help() {
- cat <<HELPEOF
-This hook displays a time-based one-time password (TOTP) sealed to a Trusted
-Platform Module (TPM) to ensure that the boot process has not been tampered
-with. To set this up, a secret needs to be generated first and sealed to the
-TPM using
-
-tpm2-totp generate
-
-This stores the secret in the TPM and displays it to the user so that it can
-be recorded on a different device (e.g. a TOTP app). When the hook is run, the
-TOTP is calculated and displayed together with the current time so that it can
-be compared with the output of the second device. This will only be successful
-and show a matching output if the boot process has not changed (new UEFI
-firmware, different boot loader, ...).
-
-When using a custom NV index with the '--nvindex index' option of tpm2-totp,
-this index needs to be specified as 'tpm2_totp_nvindex=index' on the kernel
-command line.
-
-Note that calculating the TOTP requires some entropy, which might be scarce
-directly after startup. If the boot process appears to be stuck, it might help
-to press some random keys to gather more entropy. A better alternative on modern
-processors is to enable the use of the hardware random number generator (RNG)
-by adding
-
-random.trust_cpu=on
-
-to the kernel command line.
-HELPEOF
-}
-
-# vim: set ft=sh ts=4 sw=4 et: