fapi-config(5)

💖 fapi-config(5) — the ~vibe~ file 💖

okay bestie, so this is the manual page for fapi-config in section 5 (File Formats Manual), and it's literally the glow-up guide for your FAPI configuration file. no cap, it's short, it's cute, and it's gonna make your TPM2 setup sing. ✨

---

🦋 SEE ALSO

• fapi-profile(5)

(yeah that's it, she's lowkey mysterious like that 🎀)

---

🌸 DESCRIPTION

It's the FAPI configuration file, babe. 💅

The FAPI parameters you can tweak via the config file are, in order:

• profile_name — the name of the default cryptographic profile, picked out of the profile_dir directory. it's giving "main character profile" 👑
• profile_dir — the directory holding every cryptographic profile FAPI knows about.
• user_dir — where your user objects live. their little home 🏠
• system_dir — where system objects, policies, and imported objects are stored.
• tcti — the TCTI interface that's gonna be used.
• system_pcrs — the PCR registers used by the system.
• log_dir — the directory for the event log.
• ek_cert_less — a switch to disable certificate verification (optional, bestie).
• ek_fingerprint — the fingerprint of the endorsement key (also optional).

so if nothing else was specified during TSS installation, the default location for the exemplary profiles is /etc/tpm2-tss/profiles/, and /etc/tpm2-tss/ is the default home for the FAPI configuration file itself. 🫶

and if you wanna live your alternative-lifestyle era, the environment variable TSS2_FAPICONF can set an alternative pathname for the FAPI configuration file. periodt.

🚨 important detail: if the system measurement files (IMA and bios) don't exist, /dev/null will be used for firmware_log_file and ima_log_file. not me being dramatic, that's just what happens.

---

✨ EXAMPLES

the FAPI configuration file is JSON encoded, bestie. like this:

{
     "profile_name": "P_ECCP256SHA256",
     "profile_dir": "/etc/tpm2-tss/fapi-profiles/",
     "user_dir": "~/.local/share/tpm2-tss/user/keystore/",
     "system_dir": "/home/myhome/keystore/system/keystore",
     "tcti": "",
     "system_pcrs" : [0, 1, 2, 3, 4, 5, 6, 7],
     "log_dir" : "/home/myhome/eventlog/",
     "firmware_log_file" : "/sys/kernel/security/tpm0/binary_bios_measurements",
      "ima_log_file" : "/sys/kernel/security/ima/binary_runtime_measurements"
}

so for this example, the default TCTI of the system will be used, and the certificates for the stored endorsement keys will be checked. 👀

but if certificate checking is not needed, you can just add this option:

"ek_cert_less": "yes"

to the config file. iconic, right? 💅

and as an alternative to the standard certificate checking, a fingerprint (hash of the public key) for the stored endorsement key can be defined in the config file, like:

"ek_fingerprint":  {     "hashAlg" : "sha256",     "digest" : "9e56...214d"     }

slay. 🌈

---

🎀 COLOPHON

this page is part of release 4.2.0 of Open Source implementation of the TCG TPM2 Software Stack (TSS2). 🦋

a description of the project, information about reporting bugs, and the latest version of this page can be found at https://github.com/tpm2-software/tpm2-tss/. go check it out, iykyk. 💜

---

👑 LICENSE

this work is licensed under the Creative Commons Attribution 4.0 International License (CC BY 4.0). for more information visit https://creativecommons.org/licenses/by/4.0/.

---

okay that's the whole page, bestie! this one's from the TPM2 Software Stack, dated JULI 2020, and yeah it really is fapi-config(5) — go forth and configure responsibly. 💖✨🌸