Check if SecureBoot is enabled:
mokutil --sb-state
Detecting the TPM 2.0 device:
sudo systemd-cryptenroll --tpm2-device=list
Enrolling the hardware token, binding to PCRs 0 and 7:
sudo systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=0+7 /dev/nvme0n1p3
verify:
sudo systemd-cryptenroll /dev/nvme0n1p3
show LUKS keyslots:
sudo cryptsetup luksDump /dev/nvme0n1p3
verify used PCRs:
sudo cryptsetup luksDump --dump-json-metadata /dev/nvme0n1p3 | grep tpm2-pcrs -A 3
Append /etc/crypttab with "tpm2-device=auto"
dm_crypt-0 UUID=5138c9cd-ff6c-4a4b-baba-5707e8517de6 none luks,discard,tpm2-device=auto
Install tmp2-tss:
sudo apt install tpm2-tools tpm2-tss
Upgrade GRUB config:
sudo update-grub
Upgrade initramfs:
sudo update-initramfs -u -k all
Verify initramfs:
sudo lsinitramfs /boot/initrd.img-$(uname -r) | grep -Ei 'tpm2|tss|cryptsetup'
read the SHA-256 PCR bank:
sudo tpm2_pcrread sha256:0,7
check TPM2 event log:
tpm2_eventlog /sys/kernel/security/tpm0/binary_bios_measurements
Disclaimer:
For better security use UKI instead of GRUB in your Ubuntu setup.