Eminyakeni yakamuva, amamojula e-TPM 2.0 ahambile ekubeni yimfihlakalo yehadiwe aya engxenyeni evamile yanoma iyiphi ikhompyutha yesimanje ene-UEFI kanye ne-Secure Boot. Lesi sihloko sichaza ukuthi iyini /dev/tpm0 kanye /dev/tpmrm0 nokuthi isetshenziswa kanjani i-tpm2_pcrread kanye ne-tpm2_pcrextend. (kanye nomyalo wawo wangempela kumathuluzi e-tpm2), kanye nokuchaza ukuthi angena kanjani ebhuthini elilinganisiwe, ukubethela kwediski, kanye nezinqubomgomo ze-PCR esayiniwe ku-Linux.
Amadokhumenti awusizo akhona, kodwa ahlakazekile phakathi kwamakhasi e-systemd man, okufakiwe kwe-wiki, namaposi aminyene kakhulu; Lapha siqoqa lonke ulwazi olubalulekile (ama-PCR, izibonelo ezingokoqobo, ubungozi nokuzivikela) ukuze abantu bezobuchwepheshe, ngisho noma bengebona ochwepheshe be-TPM, bakwazi ukusebenza ngalawa mathuluzi ngaphandle kokulahleka emininingwaneni engacacile.
Iyini i-TPM 2.0 nokuthi kungani ungase uyikhathalele
I-Trusted Platform Module iyi-chip yezokuphepha ehlala ebhodini lakho lomama (noma ngaphakathi kwe-CPU njenge-fTPM/Intel PTT) futhi isebenza njengesitolo esivikelekile, umshini wokuphehla izinombolo ongahleliwe, kanye nomsuka wokwethenjwa wesistimu. Akunakwenziwa: uma ungayisebenzisi, ayenzi lutho., kodwa uma uyihlanganisa ekugelezeni kwebhuthi yakho nasekubetheleni kwediski, ikunikeza ukuqinisekiswa kobuqotho nokhiye abavikelwe ngehadiwe.
Empeleni, i-TPM 2.0 ikuvumela ukuthi usebenzise izindlela ezimbili eziyinhloko ekubethelweni kwediski: a) khiqiza/gcina ukhiye oqinile futhi uvikele ukusetshenziswa kwawo nge-PIN ene-anti-brute force lock; b) vula lokho okubizwa nge-boot elinganisiwe, lapho Ingxenye ngayinye yokuqalisa ikalwa kumarekhodi e-PCR, ngakho-ke ukhiye "uvuliwe" kuphela uma isistimu ingaphazanyiswanga (futhi ngokuzikhethela ngephinikhodi yokuqalisa ngaphambilini).
/dev/tpm0 kanye /dev/tpmrm0: umehluko nokuthi isetshenziswa nini ngayinye
Ku-Linux uzobona amadivaysi ezinhlamvu ezimbili lapho i-TPM 2.0 itholakala. /dev/tpm0 isixhumi esibonakalayo “esiluhlaza” se-TPMngenkathi /dev/tpmrm0 idalula ukufinyelela ngeSiphathi Sensiza (umphathi ophindaphinda amaklayenti, ophatha izikhathi nezisetshenziswa), okuyiyona enconywe amathuluzi we-tpm2 kuzimo eziningi.
Uma ungaqiniseki ukuthi ikhona yini i-TPM noma cha, ungayihlola ngokushisayo. Uma i-/sys/class/tpm/ ingenalutho noma umyalo we-wiki awubuyi lutho, ayikho i-TPM ebonakalayo: Kungenzeka ingekho ngokoqobo noma ingase ikhutshazwe ku-firmware.
# ¿Hay TPM 2.0?
ls /sys/class/tpm/
cat /sys/class/tpm/tpm*/tpm_version_major
# Dispositivos
ls -l /dev/tpm*
Uma womabili amanodi edivayisi ekhona, amathuluzi e-tpm2 ngokuvamile azothola i-/dev/tpmrm0 futhi ayisebenzise ngokuzenzakalelayo. Uma udinga ukuphoqa idivayisi, amathuluzi amaningi ayamukela –tcti noma usebenzise okuguquguqukayo kwemvelo ye-TCTI, kodwa emisebenzini evamile akudingekile.
Ama-TPM PCR: Asebenza kanjani nokuthi akala ini
I-Platform Configuration Registers amarekhodi agcina ama-hash (imvamisa engu-SHA-256) wesimo sezingxenye ezibalulekile esigabeni ngasinye sokuqalisa. Aqaliswa abe uziro emjikelezweni wokukhulisa amandla futhi "anganwetshwa" kuphela: ungalokothi ubhale kabusha noma usule (ngaphandle kwezimo zokususa iphutha njenge-PCR 16).
Umsebenzi oyinhloko isandiso: new_value = SHA256(current_value || SHA256(data))Lena yindlela izilinganiso eziboshwe ngayo ndawonye ngaphandle kokuvumela ukusetha kabusha okungosomathuba. Le phethini isetshenziselwa ukukala i-firmware, ukulungisa, i-Secure Boot, i-kernel, initrd, namapharamitha e-kernel, phakathi kokunye.
Emishinini yesimanje uzobona ama-PCR angama-24 (0–23). Okubaluleke kakhulu ku-UEFI boot nge-systemd kukhona:
- I-PCR 0: ikhodi ye-firmware.
I-PCR 1: ukucushwa kwe-firmware (izilungiselelo ze-UEFI).
– I-PCR 7: Vikela isimo se-Boot kanye nezitifiketi ezethembayo.
– PCR 9: initrd(ama)kalwa nge-kernel.
- I-PCR 11: I-UKI (Isithombe Se-Kernel Ehlanganisiwe) namamaki wesigaba nge-systemd-stub/systemd-pcrphase.
- I-PCR 12: umugqa womyalo we-kernel.
Funda futhi wandise ama-PCR ngamathuluzi e-tpm2: tpm2_pcrread kanye ne-tpm2_pcr_extend
Kumathuluzi we-tpm2 ukufunda kwenziwa ngawo tpm2_pcrread kanye nesandiso nge tpm2_pcrextend. Kwesinye isikhathi uzobona okuthi “tpm2_pcr_extend” okubhekiselwa kukho njengokusebenza komqondo kokunwetshwa, kodwa Umyalo wangempela we-suite uthi tpm2_pcrextend.
Ukuhlola isimo samanje sama-PCR I-SHA-256, ilula njenge:
# Leer PCRs en SHA-256 (ejemplos de índices habituales)
sudo tpm2_pcrread sha256:0,1,7,9,11,12
# O todos los PCRs SHA-256 disponibles
tpm2_pcrread sha256:all
Ukuze unwebe i-PCR nge-hashi yedatha engafanele (njengesibonelo sokufundisa, i-hashi ethi /etc/passwd), bala i-SHA-256 futhi uyinwebe. Khumbula: i-TPM ayitholi idatha enkulu, kodwa i-hashi yayo, ngemikhawulo nangokuklama.
# 1) Guardar el hash de /etc/passwd
echo -n $(sha256sum /etc/passwd | cut -d' ' -f1) > passwd.sha
# 2) Extender PCR 7 (ejemplo) con el hash previo
sudo tpm2_pcrextend 7:sha256=$(cat passwd.sha)
# 3) Ver el nuevo valor del PCR 7
tpm2_pcrread sha256:7
Uma ufuna ukukhiqiza kabusha izibalo zokunwetshwa ngaphandle kwe-TPM, Uhlanganisa inani lamanje le-PCR (kanambambili) ne-hashi entsha bese usebenzisa i-SHA-256 futhi ukuze uhlole umphumela.
Ingabe i-PCR ingasethwa kabusha?
Ngaphansi kwezimo ezijwayelekile, cha. Ifilosofi iwukuthi i-PCR ikhula ngezandiso kuphelaKukhona okuhlukile: I-PCR 16 ngokuvamile igcinelwe "ukulungisa iphutha" futhi ingasethwa kabusha ngokugeleza okuthile, kodwa ayisebenziseki njengempande yokuvikeleka yenqubomgomo yakho.
I-Measured Boot, i-LUKS, ne-systemd-cryptenroll: Ukuhlanganisa Izingcezu
Uma uhlanganisa i-TPM ekubetheleni kwediski yakho, ungakwazi "ukubopha" ukhiye wokuvula kusethi yama-PCR. Uma ebhuthini yamanje lawo ma-PCR anamanani afanayo nangesikhathi ubhalisa ukhiye, i-TPM ayivaliwe futhi ivolumu ye-LUKS ivulwa ngokuzenzakalelayo (nge-PIN noma ngaphandle kwayo, kuye ngokucushwa kwakho).
Lokhu kwenziwa kahle kakhulu nge-systemd-cryptenroll kanye ne-systemd-cryptsetup. Umqondo uwukudala ivolumu yakho, ubhalise ukhiye we-TPM, bese wengeza ukhiye wokutakula. ukuze ungasali ngaphandle uma izilinganiso zishintsha (isibonelo, ngemva kokubuyekeza i-firmware noma i-kernel).
# Ejemplo: crear LUKS, matricular TPM y añadir recuperación (pseudoflujo)
# 1) Crear el volumen con contraseña temporal
sudo cryptsetup luksFormat /dev/nvme0n1p2
# 2) Matricular TPM en LUKS usando PCRs concretos y PIN
sudo systemd-cryptenroll \
--tpm2-device=auto \
--tpm2-with-pin=yes \
--tpm2-pcrs=1+2+3+4 \
--wipe-slot=empty \
/dev/nvme0n1p2
# 3) Añadir clave de recuperación aleatoria
sudo systemd-cryptenroll --recovery-key /dev/nvme0n1p2
# 4) Abrir con TPM o con recovery cuando proceda
systemd-cryptsetup attach root /dev/nvme0n1p2 - tpm2-device=auto
Uma uphoqa umehluko (isibonelo, welula i-PCR 4 ngenhloso), i-TPM ngeke isakhulula ukhiye futhi uzodinga ukusebenzisa ukhiye wokutakula. Ungakwazi ukubhalisa kabusha i-TPM ngamavelu amasha wamanje usebenzisa -wipe-slot=tpm2 kanye nokunye ukukhishwa kwe-systemd-cryptenroll.
Imaphi ama-PCR ongawakhetha futhi kungani
Ama-PCR ahlobene kakhulu owaxhumayo, yilapho unciphisa khona indawo engaphezulu, kodwa kaningi kuyodingeka ukuthi ubhalise kabusha ngemva kwezinguquko ezisemthethweni. Ezinye izindlela ezisebenzayo:
- I-PCR 7 (I-Boot Evikelekile): Kufanele izinze kakhulu uma ukhiye wakho ungashintshi.
- I-PCR 0/1 (i-firmware nokucushwa): Lokhu akuvamile ukushintsha; zidinga ukubhaliswa kabusha ngemva kokubuyekeza i-firmware noma ukushintsha i-BIOS/UEFI.
- I-PCR 9/11/12 (i-kernel, i-initrd, i-UKI ne-cmdline): Lokhu kushintsha njalo uma ungayisebenzisi i-UKI noma isiginesha/inqubomgomo ezinzile.
Kwezinye izindawo kubonakale kuxhumanisa i-PCR 7 kuphela, kuncike ekuqinisekiseni i-Secure Boot kernel kanye ne-initrd uma iqalwa njenge-UKI esayiniwe futhi isebenzisa i-systemd-boot ayikuvumeli ukuhlela amapharamitha e-kernel uma i-SB isebenza. Lokho kuyasebenza, kodwa uma i-Secure Boot yakho incike kokhiye benkampani yangaphandle (njenge-Microsoft 3rd Party) kulula ukuhlela enye ibhuthi egcina i-PCR 7 futhi ngenxa yalokho. Akuyona inketho enemingcele kakhulu.
Izinqubomgomo ze-UKI ne-PCR zisayiniwe: ukuzinza ngaphandle kokulahlekelwa ukuphepha
Isixazululo esisebenzayo sokugwema ukubhalisa kabusha njalo uma ubuyekeza i-kernel ukusebenzisa I-UKI (Isithombe Se-Kernel Ehlanganisiwe) kanye nenqubomgomo ye-PCR esayiniweUkhiqiza ipheya yokhiye, ubophe ukhiye osesidlangalaleni ku-TPM lapho ubhalisa, futhi usayine i-UKI yakho ngemva kwesibuyekezo ngasinye. I-TPM iyayethemba leyo siginesha futhi ivumela ukuvula ngisho noma i-kernel hash ethile ishintsha.
Ithuluzi le-systemd-measure kanye nomsizi we-systemd-ukify kwenza lokhu kube lula: ukify amaphakheji i-kernel, initrd kanye ne-cmdline ku-UKI (ngokuvamile kukalwa nge-PCR 11) futhi i-systemd-measure isayina inqubomgomo. Nge-mkinitcpio, ukify ingahlanganiswa ukuze emva kokufaka isignesha iyazikhiphela yona.
# Esquema típico (pseudocomandos)
# 1) Crear claves para política PCR firmada
openssl genpkey -algorithm RSA -out /etc/kernel/pcr-initrd.key.pem -pkeyopt rsa_keygen_bits:3072
openssl req -new -x509 -key /etc/kernel/pcr-initrd.key.pem -out /etc/kernel/pcr-initrd.pub.pem -subj "/CN=UKI PCR Policy"
# 2) Configurar ukify/mkinitcpio para generar UKI y firmar política
# (consultar man ukify y systemd-measure para parámetros)
# 3) Matricular en LUKS atando PCRs y clave pública de la política
sudo systemd-cryptenroll \
--tpm2-device=auto \
--wipe-slot=tpm2 \
--tpm2-with-pin=yes \
--tpm2-pcrs=0+1+2+7 \
--tpm2-public-key=/etc/kernel/pcr-initrd.pub.pem \
--tpm2-public-key-pcrs=11 \
/dev/nvme0n1p2
Ngale ndlela, Inqubomgomo yakho ihlala izinzile ngokumelene nezinguquko ze-kernel/initrd inqobo nje uma uqhubeka nokusayina i-UKI ngokhiye wakho.Uma uvuselela amaphasiwedi akho noma ushintsha isethi ye-PCR yakho, uzodinga ukubhalisa kabusha.
Izibonelo zamaketanga okulinganisa nge-systemd
Ngesikhathi sokuqalisa, i-systemd-stub ne-systemd-pcrphase inweba ama-PCR ngezikhathi ezithile. Isibonelo, i-“enter-initrd” irekhodwa ku-PCR 11, okuvumela ukuvula ukuthi kuvumeleke kuphela ngaphakathi kwe-initrd (kunciphisa ama-vectors lapho umhlaseli ezama ukusebenzisa ukhiye kamuva).
Kuzinhlelo ezine-UKI, okuqukethwe kwe-UKI kukalwa nge-PCR 11; kumasistimu angenayo i-UKI, I-kernel ikala i-initrds ku-PCR 9 futhi i-bootloader ingakala i-cmdline ku-PCR 12. Qiniseka ukuthi ufaka i-initrd ne-cmdline kupholisi yakho, noma othile ngemuva kwendlu i-initrd noma ibhuthi ene-cmdline enonya njenge init=/bin/bash.
Izingozi zangempela: i-cold boot, ukuhogela kwe-TPM, nokuningi
Yini engase yonakale? Izinto eziningana okufanele uzazi lapho umodela izinsongo. Ukuhlasela kwebhuthi ebandayo zisasebenza: uma ukuvula kuzenzakalela ngokugcwele, umhlaseli angaphinda imizamo engenamkhawulo. Ukwehliswa okucacile wukufuna iphinikhodi yokuqalisa kabusha (i-PBA), ukwehlisa imizamo ibe eyodwa ngomjikelezo wamandla ngamunye.
Esinye isigaba yi ukuhlaselwa okuhogela ibhasi le-TPMI-CPU icela ukhiye, i-TPM iyawuthumela; uma isixhumanisi sithintwa, ukhiye ungavuza. Kulokhu, i-systemd isebenzisa "ukubethela kwepharamitha" ukuze ukushintshanisa kubethelwe; okunye, ukusebenzisa i-fTPM/Intel PTT noma inkumbulo ebethelwe kunciphisa ukuchayeka. Kunemibukiso yomphakathi ethengekayo (ngisho nama-microcontroller) ekhombisa ukuba nokwenzeka kumakhompyutha aphathekayo amakhulu.
Kubuye kube khona ukukhubazeka kwezemfundo nokusebenzayo: I-TPM-Fail, i-faultTPM (enomthelela obonakalayo ku-AMD) kanye necala i-bitpixie (CVE-2023-21563)Lokhu akusho ukuthi i-TPM ayinamsebenzi, kodwa kufanele ugcine i-firmware yakho isesikhathini, uqonde imodeli yakho yokusongela, futhi ungayithembi ngokungaboni.
Isimo se-BitLocker ngokumelene nalezi zinsongo
Emhlabeni weWindows, ukubethela kwediski okusatshalaliswe kakhulu yi-BitLocker. Manje sekuphawuliwe ukuthi ukucushwa kwayo okuzenzakalelayo (ukuvula ngokuzenzakalelayo kuphela nge-TPM) Ishiya umnyango uvulelwe kokubili ibhuthi ebandayo kanye nokuhogela kwesiteshi se-TPM, njengoba ingasebenzisi ukubethela kwepharamitha yesitayela se-systemd. Lokhu kwenza amakhompyutha athile ezinkampani abe sengozini yokuhlaselwa emizuzwini embalwa.
Isincomo esikhona esokuvumela ukuqinisekiswa kwe-pre-boot ngezinqubomgomo/ngokubhalisa noma i-CLI, into engavezwanga ngokwanele kumsebenzisi ojwayelekile. Futhi, khumbula ukuhlola lapho ukhiye wokutakula ugcinwe khona: ngokuvamile uhlala ku-akhawunti ye-Microsoft yomsebenzisi, okuyinto Ngenye i-engeli yengozi uma ingalawulwa.
Iqhinga Elihlaselayo/Lokuvikela: Faka esikhundleni impande ye-LUKS ukuze uphoqelele iphasiwedi yakho
Kukhona i-vector ethakazelisayo uma kungekho ukuqinisekiswa kwe-pre-boot. Umhlaseli angakwazi ukuhlanganisa ukwahlukanisa kwangempela kwe-LUKS, buyisela enye i-LUKS nge-UUID efanayo nephasiwedi ayaziyo, bese uvula ikhompuyutha. Njengoba izilinganiso ze-PCR zifana, i-TPM ikhulula ukhiye, kodwa ayifani ne-LUKS mbumbulu, ngakho-ke i-initrd izocela ukhiye "wokubuyisela". Ngokufaka iphasiwedi eyaziwa umhlaseli, isistimu yakho isebenza njengempande ku-initrd, futhi ungakwazi ukuhlela ukuntshontshwa kokhiye wangempela (isibonelo, ngokukhweza ikhophi yangempela kunethiwekhi nokusebenzisa i-systemd-cryptsetup).
Ukunciphisa okucacile: vula ukufakazela ubuqiniso kwangaphambi kokuqalisa, phakamisa i-systemd-pcrphase ukuhlanganisa ukuvula ngokuqinile esigabeni sokuqala, futhi ucabangele ukulinganisa/ukubopha nevolumu ye-LUKS eqondiwe (idinga idizayini ecophelelayo ukuze igweme imibuthano enonya).
Ukukhetha ukwahlukanisa kanye nokhiye wesibili: ukwenza okuhle kakhulu
Gcina ukhiye wokutakula Kuyisibopho: uma i-TPM noma i-motherboard ifa, ukhiye wakho oboshelwe ku-TPM awunamsebenzi. I-LUKS ivumela izikhala eziningi (i-TPM isebenzisa eyodwa, ukutakula kusebenzisa enye). Ukwengeza, ukuhlukanisa izingxenye / kanye / zekhaya kunezinzuzo: ungafaka isicelo ukulinganisa okuqinile nge-TPM a/ futhi usebenzise ukhiye oqinile noma idivayisi ye-FIDO2/YubiKey/yasekhaya, ukwehlisa ukwethembana kumshini owodwa.
Kwenzekani uma ubuyekeza i-firmware noma i-kernel?
Uma ushintsha i-firmware noma uthinta izinketho ze-UEFI, ama-PCR afana no-0/1 azoshintsha futhi i-TPM ngeke ikhulule ukhiye uze ubhalise kabusha. Ngokuba i-kernel kanye ne-initrd, izinguquko zivamileUma ungayisebenzisi i-UKI enenqubomgomo esayiniwe, isibuyekezo ngasinye singakuphoqa ukuthi usebenzise inketho yokutakula futhi uphinde ubhalise ngokuhamba kwesikhathi. Nge-UKI esayiniwe, uvele uyisayine bese kuba kanjalo.
Amanothi Omphakathi kanye Nokubhekwa
Kweminye imihlahlandlela edumile yokusabalalisa okuthile kuye kwatuswa bopha kuphela i-PCR 7 noma kunini uma usebenzisa i-UKI ne-systemd-boot, ethembele ekuvikelweni kwe-Secure Boot kanye nokungakwazi ukuhlela i-cmdline. Kuyasebenza, kodwa kunezingozi uma uthembele kubantu besithathu. Isiphazamisi siphinde sabhalwa esikhathini esedlule lapho ukushaya u-Enter kuzoletha igobolondo lokutakula ngemva kokuvula; kuwumqondo omuhle ukugcina izinguqulo zakho zisesikhathini samanje ukuze ugweme lezimanga.
Amazwana athakazelisayo abiwe ngo-2025/06: Iphutha le-TPM liyaqhubeka nokuthinta i-AMD ngezinga elithile; ama-wikis angeze izigaba ezithile kuzinqubomgomo ze-PCR esayiniwe; kanye nesifaki sokusabalalisa esinikeza i-FDE nge-TPM njengesici sokuhlola sahlolwa, ngokuhixaka okuthile (okudinga ukutakula ekuqaliseni kokuqala, ukuncika ekufinyezweni, ukubethela kwamadiski aphindwe kabili), udaba oluthi ifanele ukucwaningwa kwamabhuku okujulile.
Ukulandelela okugxile ekubethelweni kwediski ku-Windows kwashicilelwa ngo-2025/07. Isiphetho sisonke siqinisa isidingo se-PBA kanye nokubethela isiteshi se-TPM., kanye nokukhawulela ukuncika kokhiye benkampani yangaphandle ku-Secure Boot.
Amathiphu okusebenza anamathuluzi we-tpm2 ne-systemd
Ukusetshenziswa kwansuku zonke: Faka i-tpm2-tools kanye ne-tpm2-tss. Isebenzisa /dev/tpmrm0 ngokuzenzakalelayo, kanye ne-tpm2_pcrread/tpm2_pcrextend ukuze kuhlolwe futhi kuhlolwe ama-PCR. Gwema ukunweba ama-PCR okukhiqiza anedatha engafanele: yenza lokhu kumalebhu noma sebenzisa i-PCR 16 ukuze uhlole.
Uma ubhalisa nge-systemd-cryptenroll: –tpm2-device=auto ithola i-TPM; -tpm2-nge-pin ingeza i-PBA; –tpm2-pcrs=… khetha ama-PCR akho; –tpm2-public-key=… kanye –tpm2-public-key-pcrs=… vula inqubomgomo ye-PCR esayiniwe (isb., eboshelwe ku-PCR 11 ye-UKI). Ungakhohlwa -sula-indawo lapho ufuna ukuhlanza slot odlule.
Uma ungenayo i-TPM futhi i-systemd ikwenza ulinde ebhuthini
Ngezikhathi ezithile, ngemva kokubuyekeza, isevisi izama ukusebenzisa i-TPM nakuba umshini wakho ungabonakali, okubangela ukuphela kwesikhathi ekuqaliseni. Okokuqala hlola ukuthi akukho /dev/tpm* evelayo noma okufakiwe kokuthi /sys/class/tpm.
# Verificación rápida
ls /dev/tpm*
ls /sys/class/tpm/
Uma ingekho i-TPM, hlola i-/etc/crypttab yakho ungabi nazo izinketho ezifana ne-tpm2-device=autoUma zikhona, zisuse futhi wakhe kabusha i-initrd yakho. Ungaphinda ukhubaze isigaba sokulinganisa kumakhompyutha ngaphandle kwe-TPM:
# 1) Eliminar referencias TPM en /etc/crypttab y regenerar initrd
sudo mkinitcpio -P # (o dracut/rebuildinitrd según distro)
# 2) Evitar carga de módulos TPM si el firmware publica algo extraño
echo -e "blacklist tpm\nblacklist tpm_tis\nblacklist tpm_crb" | sudo tee /etc/modprobe.d/no-tpm.conf
# 3) Opcional: evitar pcrphase si te da problemas
sudo systemctl mask systemd-pcrphase.service
Lokhu kuqeda ukulinda okungadingekile uma okokusebenza kwakho kungenayo i-TPM. Uma kamuva unika amandla i-TPM ku-BIOS/UEFI, susa uhlu oluvinjelwe futhi uvule iyunithi ukuze ubuyisele izilinganiso.
Imikhuba emihle nezinqumo zokwethenjwa
Abanye abantu bayayiqaphela i-TPM ngoba "ibhokisi elimnyama," njengamadiski azibhalayo. Lokhu ukungabaza okunengqondo. Hlola imodeli yakho yokusongela futhi ibhalansisa ukusebenziseka, ubumfihlo, nokugcinwa. Kubantu abaningi, i-TPM+PBA+esayine i-UKI iwukugxuma okukhulu kwezokuphepha ngaphandle kokungqubuzana okukhulu.
Ku-hardware ekuvumelayo, engeza inkumbulo ebethelwe futhi ugweme ukuthembela kokhiye benkampani yangaphandle kokuthi Secure Boot; khawulela iketango kokhiye bakho noma nini lapho kunokwenzeka. Gcina i-firmware ne-kernel ibuyekeziwe ukuze ihlanganise nokunciphisa ubungozi obushicilelwe.
I-Mastering /dev/tpm0, /dev/tpmrm0, kanye nemisebenzi ye-tpm2_pcrread/tpm2_pcr_extend ivula umnyango wokulinganisa ukuqalisa nokubethelwa kwediski okuqinile ku-Linux; nge-UKI kanye nenqubomgomo ye-PCR esayiniwe, ufinyelela ukuzinza kokusebenza, futhi ukwengeza iphinikhodi yokuqalisa futhi kukuvikela ekuhlaselweni okungokoqobo okwengeziwe. Ukhiye ukukhetha kahle ama-PCR, usayine ukuthi yiziphi izinguquko ezivame ukushintshwa futhi uhlale ugcina ukhiye wokutakula omuhle..
