Systemd 261 Introduces TPM PCR Changes That May Break Disk Encryption
The new systemd-pcrosseparator service in version 261 modifies TPM register values, requiring users to re-enroll their encrypted drives to avoid boot failures.
Systemd 261 ships with systemd-pcrosseparator, a new service that changes TPM register values.
The service registers an "os-separator" string to the TPM after firmware measurements finalize. This alters values stored in TPM registers 0-7, 9, and 12-14. If you rely on these registers for automated LUKS disk unlocking or other security operations, existing configurations will fail after you reboot.
PCR values usually stay static unless firmware updates or Secure Boot key modifications happen. While sudden shifts normally indicate system integrity issues or rootkit infections, this specific change is intentional.
Rolling-release distributions are already adopting systemd 261. Practical impact depends on when initial ramdisk generators incorporate the updates. Arch Linux adopted the change in mkinitcpio version 42.
You need to back up current TPM register values before applying updates. Run tpm2_pcrread to preserve state data, and use tpm2_eventlog to capture BIOS measurements. Because the event log does not record the "os-separator" addition, comparing logs before and after the update confirms whether the shift stems from the new systemd service or unauthorized tampering.
If encrypted drives fail to unlock or security checks fail after updating, you must re-enroll the new PCR values. Validating event logs against archived versions lets you distinguish expected behavior from security incidents.