Automatic decrypt with TPM2 on Silverblue

I use such a setup as my daily driver so I can confirm that you can do this with some caveats, namely that Silverblue does not actually validate the integrity of initramfs images or kernel command line parameters under Secure Boot, allowing for pretty trivial bypassing of the TPM security if someone has extended access to your machine (see initramfs: signature checks · Issue #1920 · coreos/rpm-ostree · GitHub).

If your only goal is to provide some reasonable security against casual attacks on the root drive but still protect your data, I would recommend using this approach along with ecryptfs which encrypts your home folder with your login password as an additional layer of protection (see 1701347 – 'authselect enable-feature with-ecryptfs' fails to run on Fedora Silverblue 30, even when prompted to do so by ecryptfs-util's ecryptfs-migrate-home command. for doing this on Silverblue).

You will indeed need to enable client side initramfs generation for this after layering the clevis packages and doing a sudo clevis luks bind -d /dev/whatever tpm2 '{"pcr_bank":"sha1","pcr_ids":"7,11"}' (7 and 11 are what Bitlocker uses, which is better than just the 7 the post you found indicates).

Also you can fix the password prompt appearing during TPM decryption with the following:

sudo systemctl edit systemd-ask-password-plymouth.service

[Service]
ExecStartPre=/bin/sleep 10

and

sudoedit /etc/dracut.conf.d/systemd-ask-password-plymouth.conf

install_items+=" /etc/systemd/system/systemd-ask-password-plymouth.service.d/override.conf "

(then trigger a new initramfs generation)

1 Like