samples: Implement script to create user config files and extend man page

Implement a script that creates the user config files in the
${XDG_CONFIG_HOME} directory and sub-directories.

Extend swtpm_setup.pod showing swtpm-create-user-config-files usage.

Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>

.gitignore

@@ -36,6 +36,7 @@ Makefile
 /etc/swtpm_setup.conf
 /patches/*
 /include/swtpm.h
+/samples/swtpm-create-user-config-files
 /samples/swtpm-localca
 /src/selinux/*.pp.bz2
 /src/selinux/swtpm.pp

configure.ac

@@ -510,6 +510,7 @@ AC_CONFIG_FILES([Makefile                   \
 		etc/swtpm_setup.conf        \
 		samples/Makefile            \
 		samples/swtpm-localca.conf  \
+		samples/swtpm-create-user-config-files \
 		include/Makefile            \
 		include/swtpm/Makefile      \
 		include/swtpm.h             \

man/man8/swtpm_setup.8

@@ -133,7 +133,7 @@
 .\" ========================================================================
 .\"
 .IX Title "swtpm_setup 8"
-.TH swtpm_setup 8 "2020-05-04" "swtpm" ""
+.TH swtpm_setup 8 "2020-08-20" "swtpm" ""
 .\" For nroff, turn off justification.  Always turn off hyphenation; it makes
 .\" way too many mistakes in technical documents.
 .if n .ad l
@@ -277,8 +277,8 @@ A file to copy \s-1TCSD\s0's system_ps_file to. The system_ps_file contains the
 needed by \s-1TCSD\s0 for key related functions.
 .Sp
 This option is only useful with \s-1TPM 1.2\s0 and in if ownership is taken.
-.IP "\fBrsa-keysize <keysize\fR> (since v0.4)" 4
-.IX Item "rsa-keysize <keysize> (since v0.4)"
+.IP "\fB\-\-rsa\-keysize <keysize\fR> (since v0.4)" 4
+.IX Item "--rsa-keysize <keysize> (since v0.4)"
 This option allows to pass the size of a \s-1TPM 2 RSA EK\s0 key, such as 2048
 or 3072. The supported keysizes for a \s-1TPM 2\s0 can be queried for using
 the \fI\-\-print\-capabilities\fR option. The default size is 2048 bits for
@@ -378,6 +378,16 @@ The following configuration files need to be created:
 \&    \-\-platform\-model QEMU
 .Ve
 .PP
+Note: The tool swtpm-create-user-config-files can be used to create such
+files (with different content):
+.PP
+.Vb 4
+\&  #> /usr/share/swtpm/swtpm\-create\-user\-config\-files
+\&  Writing /home/stefanb/.config/swtpm_setup.conf.
+\&  Writing /home/stefanb/.config/swtpm\-localca.conf.
+\&  Writing /home/stefanb/.config/swtpm\-localca.options.
+.Ve
+.PP
 The following commands now create a \s-1TPM 2\s0 with an \s-1EK\s0 and platform
 certificate. The state of the \s-1TPM 2\s0 will be stored in the directory
 ${\s-1XDG_CONFIG_HOME\s0}/mytpm1.

man/man8/swtpm_setup.pod

@@ -272,6 +272,14 @@ The following configuration files need to be created:
     --platform-version 2.12
     --platform-model QEMU
 
+Note: The tool swtpm-create-user-config-files can be used to create such
+files (with different content):
+
+  #> /usr/share/swtpm/swtpm-create-user-config-files
+  Writing /home/stefanb/.config/swtpm_setup.conf.
+  Writing /home/stefanb/.config/swtpm-localca.conf.
+  Writing /home/stefanb/.config/swtpm-localca.options.
+
 The following commands now create a TPM 2 with an EK and platform
 certificate. The state of the TPM 2 will be stored in the directory
 ${XDG_CONFIG_HOME}/mytpm1.

samples/Makefile.am

@@ -9,6 +9,7 @@ samplessysconfdir = $(sysconfdir)
 
 samplesconf_SCRIPTS = \
 	swtpm-create-tpmca \
+	swtpm-create-user-config-files \
 	swtpm-localca
 
 samplessysconf_DATA = \
@@ -23,6 +24,7 @@ install-data-local:
 
 EXTRA_DIST= \
 	swtpm-create-tpmca \
+	swtpm-create-user-config-files \
 	swtpm-localca \
 	swtpm-localca.conf \
 	swtpm-localca.options

samples/swtpm-create-user-config-files.in

@@ -0,0 +1,78 @@
+#!/usr/bin/env bash
+
+if [ -z "${XDG_CONFIG_HOME}" ]; then
+	echo "Environment variable XDG_CONFIG_HOME is not set."
+	exit 1
+fi
+
+SWTPM_LOCALCA_DIR="${XDG_CONFIG_HOME}/var/lib/swtpm-localca"
+
+SWTPM_SETUP_CONF="${XDG_CONFIG_HOME}/swtpm_setup.conf"
+SWTPM_LOCALCA_CONF="${XDG_CONFIG_HOME}/swtpm-localca.conf"
+SWTPM_LOCALCA_OPTIONS="${XDG_CONFIG_HOME}/swtpm-localca.options"
+
+FLAG_OVERWRITE=1
+
+function help() {
+	cat <<_EOF_
+Usage: $1 [options]
+
+The following options are supported:
+--overwrite	: Overwrite existing config files
+
+--help|-h|-?	: Display this help screen and exit
+
+_EOF_
+}
+
+function main() {
+	local flags=0
+
+	while [ $# -ne 0 ]; do
+		case "$1" in
+		--overwrite) flags=$((flags | FLAG_OVERWRITE));;
+		--help|-h|-?) help $0; exit 0;;
+		*) echo -e "Unknown option $1\n" >&2; help $0; exit 1;;
+		esac
+		shift
+	done
+
+	if [[ $((flags & FLAG_OVERWRITE)) -eq 0 ]]; then
+		for f in "${SWTPM_SETUP_CONF}" \
+			"${SWTPM_LOCALCA_CONF}" \
+			"${SWTPM_LOCALCA_OPTIONS}"; do
+			if [ -f "${f}" ]; then
+				echo "File ${f} already exists. Refusing to overwrite." >&2
+				exit 1
+			fi
+		done
+	fi
+
+	mkdir -p "${SWTPM_LOCALCA_DIR}"
+
+	echo "Writing ${SWTPM_SETUP_CONF}."
+	cat <<_EOF_ > "${SWTPM_SETUP_CONF}"
+create_certs_tool = @DATAROOTDIR@/swtpm/swtpm-localca
+create_certs_tool_config = ${SWTPM_LOCALCA_CONF}
+create_certs_tool_options = ${SWTPM_LOCALCA_OPTIONS}
+_EOF_
+
+	echo "Writing ${SWTPM_LOCALCA_CONF}."
+	cat <<_EOF_ > "${SWTPM_LOCALCA_CONF}"
+statedir = ${SWTPM_LOCALCA_DIR}
+signingkey = ${SWTPM_LOCALCA_DIR}/signkey.pem
+issuercert = ${SWTPM_LOCALCA_DIR}/issuercert.pem
+certserial = ${SWTPM_LOCALCA_DIR}/certserial
+_EOF_
+
+	echo "Writing ${SWTPM_LOCALCA_OPTIONS}."
+	cat <<_EOF_ > "${SWTPM_LOCALCA_OPTIONS}"
+--platform-manufacturer $(uname -s | tr " " "_")
+--platform-version $(uname -r | tr " " "_")
+--platform-model $(uname -s | tr " " "_")
+_EOF_
+
+	exit 0
+}
+
+main "$@"