1tpm2_clearcontrol(1)        General Commands Manual       tpm2_clearcontrol(1)
2
3
4

NAME

6       tpm2_clearcontrol(1) - Set/ Clear TPMA_PERMANENT.disableClear attribute
7       to effectively block/ unblock lockout authorization handle for  issuing
8       TPM clear.
9

SYNOPSIS

11       tpm2_clearcontrol [OPTIONS] [ARGUMENT]
12

DESCRIPTION

14       tpm2_clearcontrol(1)  -  Allows  user  with knowledge of either lockout
15       auth and or platform hierarchy auth to set disableClear which  prevents
16       the lockout authorization's capability to execute tpm2_clear.  Only us‐
17       er with authorization knowledge of the platform hierarchy can clear the
18       disableClear.  By default it attempts to clear the disableClear bit.
19
20       Note:  Platform  hierarchy  auth handle can always be used to clear the
21       TPM with tpm2_clear command.
22

OPTIONS

24       · -C, --hierarchy=OBJECT:
25
26         Specifies what auth handle, either platform hierarchy or lockout  the
27         tool should operate on.  By default it operates on the platform hier‐
28         archy handle.  Specify the handle as p|l|platform|lockout.
29
30         NOTE : Operating on platform hierarchy require  platform  authentica‐
31         tion.
32
33       · -P, --auth=AUTH:
34
35         The  authorization  value  of  the hierarchy specified with -C.  This
36         tool only respects the Password and HMAC options.
37
38       · ARGUMENT ** Specify an integer 0|1 or string c|s to clear or set  the
39         disableClear attribute.
40
41   References

Context Object Format

43       The  type  of a context object, whether it is a handle or file name, is
44       determined according to the following logic in-order:
45
46       · If the argument is a file path, then the file is loaded as a restored
47         TPM transient object.
48
49       · If the argument is a prefix match on one of:
50
51         · owner: the owner hierarchy
52
53         · platform: the platform hierarchy
54
55         · endorsement: the endorsement hierarchy
56
57         · lockout: the lockout control persistent object
58
59       · If  the  argument argument can be loaded as a number it will be treat
60         as a handle, e.g.  0x81010013 and used directly.OBJECT.
61

Authorization Formatting

63       Authorization for use of an object in TPM2.0 can come  in  3  different
64       forms: 1.  Password 2.  HMAC 3.  Sessions
65
66       NOTE:  "Authorizations  default  to  the EMPTY PASSWORD when not speci‐
67       fied".
68
69   Passwords
70       Passwords are interpreted in the following  forms  below  using  prefix
71       identifiers.
72
73       Note:  By  default  passwords are assumed to be in the string form when
74       they do not have a prefix.
75
76   String
77       A string password, specified by prefix  "str:"  or  it's  absence  (raw
78       string without prefix) is not interpreted, and is directly used for au‐
79       thorization.
80
81   Examples
82              foobar
83              str:foobar
84
85   Hex-string
86       A hex-string password, specified by prefix "hex:" is converted  from  a
87       hexidecimal  form  into a byte array form, thus allowing passwords with
88       non-printable and/or terminal un-friendly characters.
89
90   Example
91              hex:0x1122334455667788
92
93   File
94       A file based password, specified be prefix "file:" should be  the  path
95       of  a  file  containing the password to be read by the tool or a "-" to
96       use stdin.  Storing passwords in files  prevents  information  leakage,
97       passwords passed as options can be read from the process list or common
98       shell history features.
99
100   Examples
101              # to use stdin and be prompted
102              file:-
103
104              # to use a file from a path
105              file:path/to/password/file
106
107              # to echo a password via stdin:
108              echo foobar | tpm2_tool -p file:-
109
110              # to use a bash here-string via stdin:
111
112              tpm2_tool -p file:- <<< foobar
113
114   Sessions
115       When using a policy session to authorize the use of an  object,  prefix
116       the  option argument with the session keyword.  Then indicate a path to
117       a session file that was created with tpm2_startauthsession(1).  Option‐
118       ally, if the session requires an auth value to be sent with the session
119       handle (eg policy password), then append a + and a string as  described
120       in the Passwords section.
121
122   Examples
123       To use a session context file called session.ctx.
124
125              session:session.ctx
126
127       To use a session context file called session.ctx AND send the authvalue
128       mypassword.
129
130              session:session.ctx+mypassword
131
132       To use a session context file called session.ctx AND send the HEX auth‐
133       value 0x11223344.
134
135              session:session.ctx+hex:11223344
136
137   PCR Authorizations
138       You  can satisfy a PCR policy using the "pcr:" prefix and the PCR mini‐
139       language.      The     PCR     minilanguage     is     as      follows:
140       <pcr-spec>=<raw-pcr-file>
141
142       The PCR spec is documented in in the section "PCR bank specifiers".
143
144       The  raw-pcr-file  is an optional the output of the raw PCR contents as
145       returned by tpm2_pcrread(1).
146
147       PCR bank specifiers (common/pcr.md)
148
149   Examples
150       To satisfy a PCR policy of sha256 on banks 0, 1, 2 and 3 use a specifi‐
151       er of:
152
153              pcr:sha256:0,1,2,3
154
155       specifying AUTH.
156

COMMON OPTIONS

158       This  collection of options are common to many programs and provide in‐
159       formation that many users may expect.
160
161       · -h, --help=[man|no-man]: Display the tools manpage.  By  default,  it
162         attempts  to  invoke  the  manpager for the tool, however, on failure
163         will output a short tool summary.  This is the same behavior  if  the
164         "man"  option argument is specified, however if explicit "man" is re‐
165         quested, the tool will provide errors from man  on  stderr.   If  the
166         "no-man"  option  if  specified, or the manpager fails, the short op‐
167         tions will be output to stdout.
168
169         To successfully use the manpages feature requires the manpages to  be
170         installed or on MANPATH, See man(1) for more details.
171
172       · -v,  --version:  Display version information for this tool, supported
173         tctis and exit.
174
175       · -V, --verbose: Increase the information that the tool prints  to  the
176         console  during  its  execution.  When using this option the file and
177         line number are printed.
178
179       · -Q, --quiet: Silence normal tool output to stdout.
180
181       · -Z, --enable-errata: Enable the application of errata fixups.  Useful
182         if  an  errata fixup needs to be applied to commands sent to the TPM.
183         Defining the environment TPM2TOOLS_ENABLE_ERRATA is equivalent.   in‐
184         formation many users may expect.
185

TCTI Configuration

187       The  TCTI  or  "Transmission  Interface" is the communication mechanism
188       with the TPM.  TCTIs can be changed for communication with TPMs  across
189       different mediums.
190
191       To control the TCTI, the tools respect:
192
193       1. The command line option -T or --tcti
194
195       2. The environment variable: TPM2TOOLS_TCTI.
196
197       Note:  The  command  line option always overrides the environment vari‐
198       able.
199
200       The current known TCTIs are:
201
202       · tabrmd     -     The     resource     manager,     called      tabrmd
203         (https://github.com/tpm2-software/tpm2-abrmd).   Note that tabrmd and
204         abrmd as a tcti name are synonymous.
205
206       · mssim - Typically used for communicating to the TPM software  simula‐
207         tor.
208
209       · device - Used when talking directly to a TPM device file.
210
211       · none  - Do not initalize a connection with the TPM.  Some tools allow
212         for off-tpm options and thus support not using a TCTI.  Tools that do
213         not  support  it  will error when attempted to be used without a TCTI
214         connection.  Does not support ANY options and MUST  BE  presented  as
215         the exact text of "none".
216
217       The  arguments  to  either  the  command line option or the environment
218       variable are in the form:
219
220       <tcti-name>:<tcti-option-config>
221
222       Specifying an empty string for  either  the  <tcti-name>  or  <tcti-op‐
223       tion-config> results in the default being used for that portion respec‐
224       tively.
225
226   TCTI Defaults
227       When a TCTI is not specified, the default TCTI is  searched  for  using
228       dlopen(3)  semantics.   The  tools  will  search for tabrmd, device and
229       mssim TCTIs IN THAT ORDER and USE THE FIRST ONE FOUND.  You  can  query
230       what TCTI will be chosen as the default by using the -v option to print
231       the version information.  The "default-tcti" key-value pair will  indi‐
232       cate which of the aforementioned TCTIs is the default.
233
234   Custom TCTIs
235       Any TCTI that implements the dynamic TCTI interface can be loaded.  The
236       tools internally use dlopen(3), and the raw tcti-name value is used for
237       the lookup.  Thus, this could be a path to the shared library, or a li‐
238       brary name as understood by dlopen(3) semantics.
239

TCTI OPTIONS

241       This collection of options are used to configure the various known TCTI
242       modules available:
243
244       · device: For the device TCTI, the TPM character device file for use by
245         the device TCTI can be specified.  The default is /dev/tpm0.
246
247         Example:   -T   device:/dev/tpm0   or   export    TPM2TOOLS_TCTI="de‐
248         vice:/dev/tpm0"
249
250       · mssim:  For  the  mssim  TCTI, the domain name or IP address and port
251         number used by the simulator  can  be  specified.   The  default  are
252         127.0.0.1 and 2321.
253
254         Example:  -T  mssim:host=localhost,port=2321  or export TPM2TOOLS_TC‐
255         TI="mssim:host=localhost,port=2321"
256
257       · abrmd: For the abrmd TCTI, the configuration string format is  a  se‐
258         ries  of  simple  key value pairs separated by a ',' character.  Each
259         key and value string are separated by a '=' character.
260
261         · TCTI abrmd supports two keys:
262
263           1. 'bus_name' : The name of  the  tabrmd  service  on  the  bus  (a
264              string).
265
266           2. 'bus_type' : The type of the dbus instance (a string) limited to
267              'session' and 'system'.
268
269         Specify the tabrmd tcti name and a config string of  bus_name=com.ex‐
270         ample.FooBar:
271
272         \--tcti=tabrmd:bus_name=com.example.FooBar
273
274         Specify the default (abrmd) tcti and a config string of bus_type=ses‐
275         sion:
276
277         \--tcti:bus_type=session
278
279         NOTE: abrmd and tabrmd are synonymous.  the various known  TCTI  mod‐
280         ules.
281

EXAMPLES

283   Set the disableClear to block the lockout authorization's access
284       to TPM clear
285
286              tpm2_clearcontrol -C l s
287
288   Clear the disableClear to unblock lockout authorization for TPM
289       clear
290
291              tpm2_clearcontrol -C p c
292

Returns

294       Tools can return any of the following codes:
295
296       · 0 - Success.
297
298       · 1 - General non-specific error.
299
300       · 2 - Options handling error.
301
302       · 3 - Authentication error.
303
304       · 4 - TCTI related error.
305
306       · 5 - Non supported scheme.  Applicable to tpm2_testparams.
307

BUGS

309       Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
310

HELP

312       See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
313
314
315
316tpm2-tools                                                tpm2_clearcontrol(1)
Impressum