tpm2-initramfs-tool(1)

🌸 tpm2-initramfs-tool(1) 🌸

okay bestie, sit DOWN, because this little icon is tpm2-initramfs-tool, and it lives in section 1 of the manual (general commands, the classics). This page is dated MAY 2019, so she's been serving since way back, and she's still that girl. 💅

---

✨ Overview ✨

So this tool is out here using the tpm2-tss software stack (https://github.com/tpm2-software/tpm2-tss), and its whole purpose — its entire main character moment — is to generate, seal, and unseal the FDE encryption key into the TPM persistent object, using TPM2 ESAPI. That's it. That's the job. She does it flawlessly. 🦋

---

💖 Name 💖

tpm2-initramfs-tool(1) — the tool you use inside initramfs to seal and unseal your FDE key to the TPM. no cap, that's literally what she's for.

---

🎀 Build and install instructions 🎀

Standard installation, standard slay. Just run these in order and don't skip steps, bestie:

$ ./bootstrap
$ ./configure
$ make
$ sudo make install

look at that. clean. iconic. 🫶

---

🔥 Usage 🔥

okay here's where it gets fun. every example below is real and you can copy it exactly, no edits:

$ ./tpm2-initramfs-tool seal -T device:/dev/tpm0

Generate and seal the key to the TPM with the default policy on PCR7 in the SHA256 bank. ✨

$ ./tpm2-initramfs-tool unseal -T device:/dev/tpm0

Unseal that key from the TPM with the default policy on PCR7 in the SHA256 bank. 🌈

$ ./tpm2-initramfs-tool seal --pcrs 0,2,4,7 --banks SHA1,SHA256 -T device:/dev/tpmrm0

Generate and seal the key to the TPM with the policy on PCR0, PCR2, PCR4, PCR7, in both the SHA1 and SHA256 banks. yes ma'am, multi-bank, multi-PCR, she's flexible like that. 💜

$ ./tpm2-initramfs-tool unseal --pcrs 0,2,4,7 --banks SHA1,SHA256 -T device:/dev/tpmrm0

Unseal the key from the TPM with the policy on PCR0, PCR2, PCR4, PCR7, in both the SHA1 and SHA256 banks. 🌸

$ ./tpm2-initramfs-tool seal --data "DATA SEALED" -P 0x81000004 -T device:/dev/tpmrm0

Seal the string "DATA SEALED" to the persistent object address 0x81000004 with the default policy on PCR7 in the SHA256 bank. custom data?? in MY persistent object?? it's more likely than you think. 😭

---

🧚 Tests and Code Coverage 🧚

Wanna see the receipts? Install lcov and configure with --enable-code-coverage, like so:

$ ./configure --enable-code-coverage
$ make check-code-coverage

coverage queen behavior honestly 👑

---

💀 Notice 💀

Every time you re-seal a new key, it will overwrite the old persistent object. so like… be aware. that old one is gone gone. no undo button, no take-backs, fr fr. 🙈

---

and that's the whole page, bestie 💖 this is tpm2-initramfs-tool, part of the General Commands section, manual page 1, and the page itself is dated MAY 2019. go seal something. go unseal something. stay iconic. periodt. ⭐