boot.initrd.systemd: make TPM2 modules optional

[elohmeier]

Description of changes

This is a follow-up to a discussion reg. #189676. On some kernel configs the TPM2 modules are not available, e.g. the Raspberry Pi kernels. This change implements a proposed fix to only pull in the TPM2 modules if they are available, fixing the "module not found" issues for these kernels and re-enabling the use of boot.initrd.systemd.

Things done

• Built on platform(s)
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• For non-Linux: Is sandbox = true set in nix.conf? (See Nix manual)
• Tested, as applicable:
  • NixOS test(s) (look inside nixos/tests)
  • and/or package tests
  • or, for functions and "core" functionality, tests in lib/tests or pkgs/test
  • made sure NixOS tests are linked to the relevant packages
• Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
• Tested basic functionality of all binary files (usually in ./result/bin/)
• 23.05 Release Notes (or backporting 22.11 Release notes)
  • (Package updates) Added a release notes entry if the change is major or breaking
  • (Module updates) Added a release notes entry if the change is significant
  • (Module addition) Added a release notes entry if adding a new NixOS module
  • (Release notes changes) Ran nixos/doc/manual/md-to-db.sh to update generated release notes
• Fits CONTRIBUTING.md.

[oxalica]

Could you move the guard to variables and also add conditions cfg.package.withTpm2Tss && cfg.package.withCryptsetup? If systemd for initrd is built without cryptsetup or TPM2 support, the module is also unnecessary. So does withFIDO2 and libfido2.

This part also need a clean up to lower the condition granularity.
https://github.com/NixOS/nixpkgs/blob/8a7499d659107387703f9090d672e1e997b311d9/nixos/modules/system/boot/systemd/initrd.nix#L412-L423

[RaitoBezarius]

Can we do something to get this to the finish line?

[ajs124]

@RaitoBezarius someone could respond to the question in my review comment

[RaitoBezarius]

@RaitoBezarius someone could respond to the question in my review comment

Answered. :)

[elohmeier]

Thanks for your feedback. The previous attempt didn't actually work. I've added a new approach with a option boot.initrd.systemd.enableTpm2 as suggested in the comments.

[ElvishJerricco]

I'd like to see this also exclude the TPM libraries, because they add a considerable amount of size to the initrd:

nixpkgs/nixos/modules/system/boot/systemd/initrd.nix

Lines 424 to 427 in 73a8ca1

	] ++ optionals cfg.package.withCryptsetup [
	# tpm2 support
	"${cfg.package}/lib/cryptsetup/libcryptsetup-token-systemd-tpm2.so"
	pkgs.tpm2-tss

FIDO2 is fine though, since it barely affects the size at all.

See this test I ran: https://gist.github.com/ElvishJerricco/ca36d26fd30b78b211aea10604b9885e#file-results-txt

[elohmeier]

I'd like to see this also exclude the TPM libraries, because they add a considerable amount of size to the initrd:

nixpkgs/nixos/modules/system/boot/systemd/initrd.nix

Lines 424 to 427 in 73a8ca1

	] ++ optionals cfg.package.withCryptsetup [
	# tpm2 support
	"${cfg.package}/lib/cryptsetup/libcryptsetup-token-systemd-tpm2.so"
	pkgs.tpm2-tss

FIDO2 is fine though, since it barely affects the size at all.

See this test I ran: https://gist.github.com/ElvishJerricco/ca36d26fd30b78b211aea10604b9885e#file-results-txt

Thanks, updated!

[Majiir]

Tested on an armv7l system which can't build with tpm-crb. Code changes LGTM.

Is this config option discoverable for anyone running into the problem? Should we include a note in the enableTpm2 description? Is it possible to detect the missing module and print a NixOS-specific error? (I don't think any of that should hold up the PR, though.)

[elohmeier]

@ElvishJerricco can you somehow resolve/close your requested change blocking the merge? I don't know how I could do that since I addressed it by force-pushing an update. Maybe you have an option in GitHub to do that?

[lopsided98]

Confirmed that this allows systemd in initrd to build on my armv7l and armv6l machines.

[elohmeier]

Please see follow-up PR here: #253498