tcsd.conf(5)

✨ tcsd.conf(5) — the TCG Software Stack glow-up ✨

okay bestie, so this is a page from the File Formats Manual and it's all about a lil file called tcsd.conf. it's giving "the setup sheet for your TPM era" and honestly? iconic. let's get into it 💅

---

🌸 NAME 🌸

tcsd.conf — the configuration file for the trousers TCS daemon. periodt.

---

🦋 DESCRIPTION 🦋

so this file, which lives at /etc/tcsd.conf by default (slay), gets read by the trousers TCSD daemon, tcsd (go look at tcsd(8), iykyk). and here's the cute part: the tcsd.conf that ships with trousers has all the default options in it already — just commented out 🫶. so you can peek at your options like window shopping, no cap.

---

✨ OPTIONS ✨

• port — the port that TCSD will listen on for connections from applications, both local and remote. she's listening, she's available, she's on that port 💖
• num_threads — the max number of threads TCSD will spawn at the same time to service applications. once num_threads threads have been spawned, any application that tries to connect to the TCSD gets an error. like sorry babe, we're at capacity 😭
• system_ps_file — where the system persistent storage file lives. this file is the one holding keys and data across restarts of the TCSD and system reboots. main character energy, fr fr.
• firmware_log_file — the path to the file with the current firmware PCR event log data. the interface to this log is usually provided by the TPM device driver. no notes 💜
• kernel_log_file — the path to the file with the current kernel PCR event log data. by default, this data will be parsed in the format provided by the Integrity Measurement Architecture LSM. she's specific, she's structured ✨
• firmware_pcrs — a list of PCR indices that are manipulated only by the system firmware, which is why they're not extended or logged by the TCSD. applications that call Tcsi_PcrExtend on PCRs listed here will receive an error. read the room, bestie.
• kernel_pcrs — a list of PCR indices manipulated only by the kernel, so again not extended or logged by the TCSD. applications that call Tcsi_PcrExtend on PCRs listed here will receive an error. same energy 💀
• platform_cred — path to the platform credential for your TPM. your TPM manufacturer may have hooked you up with a set of credentials (certificates) that should be used when creating identities using your TPM. when a user of your TPM makes an identity, this credential will be encrypted as part of that process. see the 1.1b TPM Main specification section 9.3 for the deets on this process 📚
• conformance_cred — path to the conformance credential for your TPM. your TPM manufacturer may have provided a set of credentials (certificates) that should be used when creating identities using your TPM. when a user of your TPM makes an identity, this credential will be encrypted as part of that process. see the 1.1b TPM Main specification section 9.3 for the whole lore.
• endorsement_cred — path to the endorsement credential for your TPM. your TPM manufacturer may have given you a set of credentials (certificates) that should be used when creating identities using your TPM. when a user of your TPM makes an identity, this credential will be encrypted as part of that process. see the 1.1b TPM Main specification section 9.3, yes again, she's thorough 💅
• remote_ops — a list of TCS commands that will be allowed to be executed on this machine's TCSD by TSPs on non-local hosts (over the internet 🌐). by default, access to all operations is denied. secure girl summer, we love to see it 🔥
• host_platform_class — determines the TCG specification of the host's platform class. this refers to one of the specifications contained in the TCG web site. the default is PC specification version 1.2. 💻
• all_platform_classes — specifies all the TCG defined platforms associated with the host platform. heads up: host_platform_class must not be defined here. by default, all platforms but the host platform are associated. 🌈

---

🎀 EXAMPLE 🎀

here's the whole vibe in one code block, copy it, love it, make it yours:

       port = 30003
       num_threads = 10
       system_ps_file = /usr/local/var/tpm/system.data
       firmware_log_file = /proc/tpm/firmware_events
       kernel_log_file = /proc/tcg/measurement_events
       firmware_pcrs = 0,1,2,3,4,5,6,7
       kernel_pcrs = 10,11
       platform_cred = /usr/local/var/lib/tpm/platform.cert
       conformance_cred = /usr/local/var/lib/tpm/conformance.cert
       endorsement_cred = /usr/local/var/lib/tpm/endorsement.cert
       remote_ops = create_key,random
       host_platform_class = server_12
       all_platform_classes = pc_11,pc_12,mobile_12

---

👑 SEE ALSO 👑

• tcsd(8) — go read her next, she's the whole point 🫶

---

💖 AUTHOR 💖

Kent Yoder — thank you king, we appreciate you ✨

---

🐛 REPORTING BUGS 🐛

found a bug? don't be shy, report it to <trousers-tech@lists.sf.net>. they wanna know, fr fr 💌

---

and that's the whole page bestie!! this one's from TSS 1.1, dated 2006-07-14, and it's been serving tcsd.conf(5) realness ever since. go configure something gorgeous 💅✨