1tpm2_createpolicy(1) General Commands Manual tpm2_createpolicy(1)
2
6 tpm2_createpolicy(1) - Creates simple assertion authorization policies
7 based on multiple pcr indices values across multiple enabled banks.
8
10 tpm2_createpolicy [OPTIONS]
11
13 tpm2_createpolicy(1) - Creates simple assertion authorization policies
14 based on multiple pcr indices values across multiple enabled banks. It
15 can then be used with object creation and or tools using the object.
16
18 These options control creating the policy authorization session:
19 · -f, –policy-file=POLICY_FILE: File to save the policy digest.
21 · -P, –policy-pcr: Identifies the PCR policy type for policy creation.
23 · -g, –policy-digest-alg=HASH_ALGORITHM: The hash algorithm used in
25 computation of the policy digest. Algorithms should follow the “for‐
26 matting standards, see section”Algorithm Specifiers“. Also, see sec‐
27 tion”Supported Hash Algorithms" for a list of supported hash algo‐
28 rithms.
29 · -L, –set-list=PCR_LIST: The list of pcr banks and selected PCRs' ids
31 (0~23) for each bank.
32 · -F, –pcr-input-file=PCR_FILE: Optional Path or Name of the file con‐
34 taining expected pcr values for the specified index. Default is to
35 read the current PCRs per the set list.
36 · -e, –extend-policy-session: Retains the policy session at the end of
38 operation.
39 · -a, –auth-policy-session: Start a policy session of type TPM_SE_POLI‐
41 CY. Default without this option is TPM_SE_TRIAL.
42
44 This collection of options are common to many programs and provide in‐
45 formation that many users may expect.
46 · -h, –help: Display the tools manpage. This requires the manpages to
48 be installed or on MANPATH, See man(1) for more details.
49 · -v, –version: Display version information for this tool, supported
51 tctis and exit.
52 · -V, –verbose: Increase the information that the tool prints to the
54 console during its execution. When using this option the file and
55 line number are printed.
56 · -Q, –quiet: Silence normal tool output to stdout.
58 · -Z, –enable-errata: Enable the application of errata fixups. Useful
60 if an errata fixup needs to be applied to commands sent to the TPM.
61 # TCTI ENVIRONMENT
62 This collection of environment variables that may be used to configure
64 the various TCTI modules available.
65 The values passed through these variables can be overridden on a
67 per-command basis using the available command line options, see the TC‐
68 TI_OPTIONS section.
69 The variables respected depend on how the software was configured.
71 · TPM2TOOLS_TCTI_NAME: Select the TCTI used for communication with the
73 next component down the TSS stack. In most configurations this will
74 be the TPM but it could be a simulator or proxy. The current known
75 TCTIs are:
76 · tabrmd - The new resource manager, called tabrmd
78 (https://github.com/01org/tpm2-abrmd).
79 · socket - Typically used with the old resource manager, or talking
81 directly to a simulator.
82 · device - Used when talking directly to a TPM device file.
84 · TPM2TOOLS_DEVICE_FILE: When using the device TCTI, specify the TPM
86 device file. The default is “/dev/tpm0”.
87 Note: Using the tpm directly requires the users to ensure that con‐
89 current access does not occur and that they manage the tpm resources.
90 These tasks are usually managed by a resource manager. Linux 4.12
91 and greater supports an in kernel resource manager at “/dev/tpmrm”,
92 typically “/dev/tpmrm0”.
93 · TPM2TOOLS_SOCKET_ADDRESS: When using the socket TCTI, specify the do‐
95 main name or IP address used. The default is 127.0.0.1.
96 · TPM2TOOLS_SOCKET_PORT: When using the socket TCTI, specify the port
98 number used. The default is 2321.
99
101 This collection of options are used to configure the varous TCTI mod‐
102 ules available. They override any environment variables.
103 · -T, –tcti=TCTI_NAME[:TCTI_OPTIONS]: Select the TCTI used for communi‐
105 cation with the next component down the TSS stack. In most configu‐
106 rations this will be the resource manager: tabrmd
107 (https://github.com/01org/tpm2-abrmd) Optionally, tcti specific op‐
108 tions can appended to TCTI_NAME by appending a : to TCTI_NAME.
109 · For the device TCTI, the TPM device file for use by the device TCTI
111 can be specified. The default is /dev/tpm0. Example: -T de‐
112 vice:/dev/tpm0
113 · For the socket TCTI, the domain name or IP address and port number
115 used by the socket can be specified. The default are 127.0.0.1 and
116 2321. Example: -T socket:127.0.0.1:2321
117 · For the abrmd TCTI, it takes no options. Example: -T abrmd
119
121 Supported hash algorithms are:
122 · 0x4 or sha1 for TPM_ALG_SHA1 (default)
124 · 0xB or sha256 for TPM_ALG_SHA256
126 · 0xC or sha384 for TPM_ALG_SHA384
128 · 0xD or sha512 for TPM_ALG_SHA512
130 · 0x12 or sm3_256 for TPM_ALG_SM3_256
132 NOTE: Your TPM may not support all algorithms.
134
136 Options that take algorithms support “nice-names”. Nice names, like
137 sha1 can be used in place of the raw hex for sha1: 0x4. The nice names
138 are converted by stripping the leading TPM_ALG_ from the Algorithm Name
139 field and converting it to lower case. For instance TPM_ALG_SHA3_256
140 becomes sha3_256.
141 The algorithms can be found at: <https://trustedcomputinggroup.org/wp-
143 content/uploads/TCG_Algorithm_Registry_Rev_1.24.pdf>
144
146 Create a authorization policy tied to a specific PCR index:
147 tpm2_createpolicy -P -L 0x4:0 -f policy.file -F pcr0.bin
149
151 0 on success or 1 on failure.
152
154 Github Issues (https://github.com/01org/tpm2-tools/issues)
155
157 See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
158tpm2-tools AUGUST 2017 tpm2_createpolicy(1)