1TB_POLGEN(8)                     User Manuals                     TB_POLGEN(8)
2
3
4

NAME

6       tb_polgen - manage tboot verified launch policy
7

SYNOPSIS

9       tb_polgen COMMAND [OPTION]
10

DESCRIPTION

12       tb_polgen is used to manage tboot verified launch policy.
13

COMMANDS

15       --create
16              Create an empty tboot verified launch policy file.
17
18              --type nonfatal | continue | halt
19                     Nonfatal means ignoring all non-fatal errors and continu‐
20                     ing. Continue  means  ignoring  verification  errors  and
21                     halting otherwise. Halt means halting on any errors.
22
23              [--ctrl policy-control-value]
24                     The default value 1 is to extend policy into PCR 17.
25
26              policy-file
27
28       --add  Add a module hash entry into a policy file.
29
30              --num module-number | any
31                     The  module-number  is  the  0-based module number corre‐
32                     sponding to modules loaded by the bootloader.
33
34              --pcr TPM-PCR-number | none
35                     The TPM-PCR-number is the PCR to extend the module's mea‐
36                     surement into.
37
38              --hash any | image
39
40              [--cmdline command-line]
41                     The  command  line  is  from grub.conf, and it should not
42                     include the module name (e.g. "/xen.gz").
43
44              [--image image-file-name]
45
46              policy-file
47
48       --del  Delete a module hash entry from a policy file.
49
50              --num module-number | any
51                     The module-number is the  0-based  module  number  corre‐
52                     sponding to modules loaded by the bootloader.
53
54              [--pos hash-number]
55                     The  hash-number is the 0-based index of the hash, within
56                     the list of hashes for the specified module.
57
58              policy-file
59
60       --unwrap
61              Extract the tboot verified launch policy from a TXT LCP  element
62              file.
63
64              --elt elt-file
65
66              policy-file
67
68       --show policy-file
69              Show the policy information in a policy file.
70
71       --help Print out the help message.
72
73       --verbose
74              Enable verbose output; can be specified with any command.
75

EXAMPLES

77       tb_polgen --create --type nonfatal vl.pol
78
79       tb_polgen  --add  --num  0  --pcr none --hash image --cmdline "cmdline"
80       --image /boot/xen.gz vl.pol
81
82       tb_polgen --add --num 1  --pcr  19  --hash  image  --cmdline  "cmdline"
83       --image /boot/vmlinuz-2.6.18.8-xen vl.pol
84
85       tb_polgen  --add  --num  2  --pcr  19 --hash image --cmdline "" --image
86       /boot/initrd-2.6.18.8-xen.img vl.pol
87
88       tb_polgen --del --num 1 vl.pol
89
90       tb_polgen --show --verbose vl.pol
91
92   Note1:
93       It is not necessary to specify a PCR for module 0, since this  module's
94       measurement  will always be extended to PCR 18.  If a PCR is specified,
95       then the measurement will be extended to that PCR in  addition  to  PCR
96       18.
97
98   Note2:
99       --unwrap  is  not implemented correctly. There should be a defined UUID
100       for this and that should be checked  before  copying  the  data.  There
101       should  be a wrap or similar command to generates an element file for a
102       policy.
103

SEE ALSO

105       lcp_crtpol(8), lcp_crtpol2(8), lcp_crtpolelt(8).
106
107
108
109tboot                             2011-12-31                      TB_POLGEN(8)