mirror of
https://github.com/stefanberger/swtpm.git
synced 2025-08-22 19:04:35 +00:00
5486f0437f
Add support for --profile-name option that searches for a profile in a configurable local directory or a distro directory (typically /usr/share/swtpm/profiles). Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
132 lines
4.0 KiB
Plaintext
132 lines
4.0 KiB
Plaintext
=head1 NAME
|
|
|
|
swtpm_setup.conf - Configuration file for swtpm_setup
|
|
|
|
=head1 DESCRIPTION
|
|
|
|
The file I</etc/swtpm_setup.conf> contains configuration information for
|
|
swtpm_setup. It must only contain
|
|
one configuration keyword per line, followed by an equals sign (=) and then
|
|
followed by appropriate configuration information. A comment at the
|
|
end of the line may be introduced by a hash (#) sign.
|
|
|
|
Users may write their own configuration into
|
|
I<${XDG_CONFIG_HOME}/swtpm_setup.conf> or if XDG_CONFIG_HOME
|
|
is not set it may be in I<${HOME}/.config/swtpm_setup.conf>.
|
|
|
|
The following keywords are recognized:
|
|
|
|
=over 4
|
|
|
|
=item B<create_certs_tool>
|
|
|
|
This keyword is to be followed by the name of an executable or executable
|
|
script used for creating various TPM certificates. The tool will be
|
|
called with the following options
|
|
|
|
=over 4
|
|
|
|
=item B<--type type>
|
|
|
|
This parameter indicates the type of certificate to create. The type parameter may
|
|
be one of the following: I<ek>, or I<platform>
|
|
|
|
=item B<--dir dir>
|
|
|
|
This parameter indicates the directory into which the certificate is to be stored.
|
|
It is expected that the EK certificate is stored in this directory under the name
|
|
ek.cert and the platform certificate under the name platform.cert.
|
|
|
|
=item B<--ek ek>
|
|
|
|
This parameter indicates the modulus of the public key of the endorsement key
|
|
(EK). The public key is provided as a sequence of ASCII hex digits.
|
|
|
|
=item B<--vmid ID>
|
|
|
|
This parameter indicates the ID of the VM for which to create the certificate.
|
|
|
|
=item B<--logfile <logfile>>
|
|
|
|
The log file to log output to; by default logging goes to stdout and stderr
|
|
on the console.
|
|
|
|
=item B<--configfile <configuration file>>
|
|
|
|
The configuration file to use. This file typically contains configuration
|
|
information for the invoked program. If omitted, the program must use
|
|
its default configuration file.
|
|
|
|
=item B<--optsfile <options file>>
|
|
|
|
The options file to use. This file typically contains options that the
|
|
invoked program uses. If omitted, the program must use its default
|
|
options file.
|
|
|
|
=item B<--tpm-spec-family <family>>, B<--tpm-spec-level <level>>, B<--tpm-spec-revision <revision>>
|
|
|
|
These 3 options describe the TPM specification that was followed for
|
|
the implementation of the TPM and will be part of the EK certificate.
|
|
|
|
=item B<--tpm2>
|
|
|
|
This option is passed in case a TPM 2 compliant certificate needs to be
|
|
created.
|
|
|
|
=back
|
|
|
|
=item B<create_certs_tool_config>
|
|
|
|
This keyword is to be followed by the name of a configuration file
|
|
that will be passed to the invoked program using the --configfile
|
|
option described above. If omitted, the invoked program will use
|
|
the default configuration file.
|
|
|
|
=item B<create_certs_tool_options>
|
|
|
|
This keyword is to be followed by the name of an options file
|
|
that will be passed to the invoked program using the --optsfile
|
|
option described above. If omitted, the invoked program will use
|
|
the default options file.
|
|
|
|
=item B<active_pcr_banks> (since v0.7)
|
|
|
|
This keyword is to be followed by a comma-separated list
|
|
of names of PCR banks. The list must not contain any spaces.
|
|
Valid PCR bank names are sha1, sha256, sha384, and sha512.
|
|
|
|
=item B<rsa_keysize> (since v0.10)
|
|
|
|
This keyword allows to specify the default RSA keysize to be used if it is
|
|
not provided with a command line option to swtpm_setup. Any value
|
|
that can be passed to swtpm_setup is also valid here, such as 2048, or
|
|
'max'. The supported key sizes depend on the version of libtpms.
|
|
|
|
=item B<profile> (since v0.10)
|
|
|
|
This keyword allows to specify either the name of a profile or a JSON
|
|
map describing the profile, such as 'profile = {"Name": "default-v1"}'.
|
|
Please also refer to the description of the I<--profile> option for
|
|
swtpm_setup.
|
|
|
|
=item B<profile_file> (since v0.10)
|
|
|
|
This keyword allows to specify a default profile file.
|
|
|
|
=item B<local_profiles_dir> (since v0.10)
|
|
|
|
This keyword allows to set a profile directory that contains profiles written
|
|
by users of the system.
|
|
|
|
=item B<>
|
|
|
|
=back
|
|
|
|
=head1 SEE ALSO
|
|
|
|
B<swtpm_setup>
|
|
|
|
=head1 REPORTING BUGS
|
|
|
|
Report bugs to Stefan Berger <stefanb@linux.vnet.ibm.com>
|