fix: kernel-install hook missing — T3 seals break on kernel update #28

New issue

Closed

opened 2026-07-29 10:59:39 +02:00 by elegos · 0 comments

elegos commented

2026-07-29 10:59:39 +02:00

Owner

Issue

EPIC-15 packaging is implemented (deb/rpm/arch scripts), but the kernel-install hook for automatic PCR re-seal is missing. This hook was explicitly scoped to EPIC-15 (docs/lld/packaging.md, docs/lld/tpm-storage.md:19–20).

Impact

On T3 systems (Secure Boot + UKI boot), every kernel update breaks the TPM seal because PCR 11 changes with the new UKI image. The daemon cannot unseal on first boot into the new kernel, causing biometric auth to fall back to password until the user manually re-seals or re-enrolls.

Fix

Implement a kernel-install plugin at /usr/lib/kernel/install.d/90-linux-hello-reseal.install that:

Detects if the user is on a T3 system.
Calls systemd-measure to predict PCR 11 for the new UKI.
Calls linux-hello-tpm reseal --all-users --predicted-pcr11 <value> before the reboot.

Install the hook in all three packaging scripts (Debian postinst, RPM %post, Arch post_install).

## Issue EPIC-15 packaging is implemented (deb/rpm/arch scripts), but the `kernel-install` hook for automatic PCR re-seal is missing. This hook was explicitly scoped to EPIC-15 (`docs/lld/packaging.md`, `docs/lld/tpm-storage.md:19–20`). ## Impact On T3 systems (Secure Boot + UKI boot), every kernel update breaks the TPM seal because PCR 11 changes with the new UKI image. The daemon cannot unseal on first boot into the new kernel, causing biometric auth to fall back to password until the user manually re-seals or re-enrolls. ## Fix Implement a `kernel-install` plugin at `/usr/lib/kernel/install.d/90-linux-hello-reseal.install` that: 1. Detects if the user is on a T3 system. 2. Calls `systemd-measure` to predict PCR 11 for the new UKI. 3. Calls `linux-hello-tpm reseal --all-users --predicted-pcr11 <value>` before the reboot. Install the hook in all three packaging scripts (Debian postinst, RPM %post, Arch post_install).

elegos added this to the Foundation project

2026-07-29 11:00:01 +02:00

elegos

2026-07-29 11:20:38 +02:00