KEYLIME-POLICY(1)

📦
version 7.14.3 · 3 versions
, in centos-stream 10

💖 KEYLIME-POLICY 💖

okay so bestie, welcome to keylime-policy(1) — a General Commands Manual situation and honestly it's giving main character energy for your whole attestation setup ✨ this is the Keylime policy creation and signing tool, and by the end of this page you're gonna know her like the back of your hand 🫶

✨ SYNOPSIS ✨

keylime-policy {create,sign} [OPTIONS]
⚠️ (Requires root privileges, use with sudo) — like, actually. sudo or nothing, bestie 💅

🌸 DESCRIPTION 🌸

keylime-policy is a utility for creating and signing Keylime policies. That's the whole vibe ngl 💜

She supports creating runtime policies (for IMA/filesystem attestation) and measured boot policies (for boot-time attestation), and she also signs runtime policies using DSSE (Dead Simple Signing Envelope). Dead Simple, and yet so iconic 😭🔥

👑 COMMANDS 👑

🎀 keylime-policy create runtime [OPTIONS]

Create runtime policies from filesystem, allowlists, RPM repositories, or IMA measurement lists. pick your source, she's flexible 💅

Options:

  • -o, --output OUTPUT — Output file (defaults to stdout, if you're feeling ✨ spontaneous ✨)
  • -p, --base-policy BASE_POLICY — Merge new data into existing JSON runtime policy
  • -k, --keyrings — Create keyrings policy entries
  • -b, --ima-buf — Process ima-buf entries other than keyrings
  • -a, --allowlist ALLOWLIST — Read checksums from plain-text allowlist
  • -e, --excludelist EXCLUDE_LIST_FILE — Add IMA exclude list to policy
  • -m, --ima-measurement-list [IMA_MEASUREMENT_LIST] — Use IMA measurement list for hash/keyring extraction
  • --ignored-keyrings IGNORED_KEYRINGS — Ignore specified keyring (repeatable — yes you can stack her 🍓)
  • --add-ima-signature-verification-key IMA_SIGNATURE_KEYS — Add x509/key to tenant_keyring (repeatable, same deal 💖)
  • --show-legacy-allowlist — Display digests in legacy allowlist format
  • -v, --verbose — Set log level to DEBUG (she gets chatty 👀)

Filesystem scanning:

  • --algo {sha1,sha256,sha384,sha512,sm3_256} — Checksum algorithm, pick your fave
  • --ramdisk-dir RAMDISK_DIR — Path to initrds (e.g., /boot)
  • --rootfs ROOTFS — Path to root filesystem (e.g., /)
  • -s, --skip-path SKIP_PATH — Comma-separated directories to skip (bye bye 👋)

Repository scanning:

  • --local-rpm-repo LOCAL_RPM_REPO — Local RPM repository directory
  • --remote-rpm-repo REMOTE_RPM_REPO — Remote RPM repository URL

🦋 keylime-policy create measured-boot [OPTIONS]

Create measured boot reference state policies from UEFI event logs. boot-time attestation era 💀✨

Options:

  • -e, --eventlog-file EVENTLOG_FILE — Binary UEFI eventlog (required — no cap, you need this one)
  • --without-secureboot, -i — Create policy without SecureBoot (MeasuredBoot only)
  • -o, --output OUTPUT — Output path for generated measured boot policy

🌈 keylime-policy sign runtime [OPTIONS]

Sign runtime policies using DSSE. glow-up time for your policy 🔥

Options:

  • -o, --output OUTPUT_FILE — Output file for DSSE-signed policy
  • -r, --runtime-policy POLICY — Runtime policy file to sign (required 💅)
  • -k, --keyfile KEYFILE — EC private key for signing
  • -p, --keypath KEYPATH — Output filename for created private key
  • -b, --backend {ecdsa,x509} — DSSE backend (ecdsa or x509)
  • -c, --cert-outfile CERT_OUTFILE — Output file for x509 certificate (x509 backend)

💖 EXAMPLES 💖

Create runtime policy from filesystem:

sudo keylime-policy create runtime --rootfs / --output my-policy.json

Create runtime policy from allowlist:

sudo keylime-policy create runtime --allowlist my-allowlist.txt --output policy.json

Create measured boot policy:

sudo keylime-policy create measured-boot -e /sys/kernel/security/tpm0/binary_bios_measurements -o mb-policy.json

Sign runtime policy:

sudo keylime-policy sign runtime -r policy.json -k signing-key.pem -o signed-policy.json

see how every single one is sudo? yeah. she meant it 🫶

🧚 ENVIRONMENT 🧚

  • KEYLIME_LOGGING_CONFIG — Path to logging.conf

⭐ NOTES ⭐

  • All operations require root privileges 👑
  • Runtime policies use JSON format
  • Measured boot policies require binary UEFI event logs
  • DSSE signing supports both ECDSA and x509 backends

🍓 SEE ALSO 🍓

keylime_tenant(1), keylime_verifier(8), keylime_registrar(8) — go read the whole friend group, iykyk 💜

🙈 BUGS 🙈

Report bugs at https://github.com/keylime/keylime/issues — not me filing a bug report at 2am but like... do it, they wanna know 😭

💜 AUTHOR 💜

Keylime Developers — legends, honestly 👑

and that's the page!! brought to you by the General Commands Manual girlies, keylime-policy(1), dated September 2025 🌸🎀✨ go forth and sign your policies, bestie 💅

📦 where this page comes from