LCP2_CRTPOL(8)

💖 LCP2_CRTPOL 💖 (section 8 of the user manuals, bestie)

okay so bestie, welcome to lcp2_crtpol — the little icon that makes an Intel TXT Launch Control Policy ✨. Yes, the whole manual page, section 8, and yes I'm gonna walk you through every single flag because I love you and I want you to slay.

🌸 NAME 🌸

lcp2_crtpol — create an Intel TXT Launch Control Policy. That's it, that's the whole vibe. 🎀

✨ SYNOPSIS ✨

lcp2_crtpol <--create|--show|--help> [--brief] [--verbose] --alg alg
--type <any|list> [LISTFILES] [--minver <ver>] [--rev
<counter1>[,counterN]] [--ctrl <pol_ctrl>] --pol <POLICY FILE> [--data
<POLICY DATA FILE>] [--mask mask] [--auxalg alg] --sign alg [--polver
version]

Like, yes, it's a lot. But we're gonna go through it together, one flag at a time, no cap. 🫶

🌈 DESCRIPTION 🌈

So here's the tea: lcp2_crtpol is the tool you use to create a TXT LCP policy (and, if you want, policy data too), which you can later write to the TPM. It's giving glow up your boot chain energy.

And the best part? This tool lets you create policies for TPM 1.2 and TPM 2.0 — versatile queen behavior, honestly. 👑

The policy format you get is decided by the --polver option, so keep that in mind, iykyk.

💅 COMMANDS 💅

• --create — creates a policy. Boom, done, new policy, slay. ✨
• --show — shows you the contents of a policy file, a policy data file, or both. If you pass one file it has to be either a policy file or a policy data file. If you pass two files, one of them must be a policy file and the other a policy data file. Like, the math has to math, bestie. 🙈
• --help — shows the help text. We love a supportive king. 💖
• --version — shows the tool version. Simple. Iconic. Periodt. ⭐

🎀 OPTIONS 🎀

• --brief — use brief format for output. short n sweet, lowkey minimalism. ✨
• --verbose — use verbose format for output. the opposite vibe, highkey chatty. 🗣️
• --alg alg — specify the algorithm for the LCP. Supported values are sha1, sha256 or sm3. pick your fighter. 🌸
• --type <any|list> — specify the type of the policy. If --type is list, you specify a comma-separated list of up to 8 policy list files (created with the lcp2_crtpollist command). eight!! that's the cap, bestie, don't push it. 🦋
• --minver version — specify minimum allowed SINIT module version number (SINITMinVersion). 🧚
• --max_sinit_min version — specify maximum allowed value of the minimal SINIT module version number (MaxSinitMinVersion). yes it's a mouthful, no I'm not renaming it, it's literally the name. 💜
• --rev <counter1>[,counterN] — specify a comma-separated list of revocation counters. bye bye to the old stuff 👋💀
• --ctrl <pol ctrl> — specify the PolicyControl value. The default is 0 (LCP_DEFAULT_POLICY_CONTROL). default queen, no notes. 🌟
• --pol <POLICY FILE> — specify the output file for the policy. the main character file, fr fr. 👑
• --data <POLICY DATA FILE> — specify the output file for the policy data. the sidekick, but a very important sidekick. 🫶
• --mask mask — specify the policy hash algorithm mask. Supported values are sha1, sha256, sha384, sha512 or sm3. This option can be used multiple times to specify several allowed algorithms. ⚠️ Policy versions 2.0-2.4 only support SHA1 — that's not a suggestion, that's just how it is, bestie.
• --auxalg alg — specify the AUX hash algorithm. Supported values are sha1, sha256, sha384, sha512 or sm3. You can also specify a raw value in hex — and it must start with "0x", no exceptions. This option is only valid for policy versions 3.0 or 3.1. 👀
• --sign alg — specify the allowed LCP signature algorithm mask. Supported values are: rsa-2048-sha1, rsa-2048-sha256, rsa-3072-sha256, rsa-3072-sha384, ecdsa-p256, ecdsa-p384 sm3. This option can be used multiple times to specify several allowed algorithms. stack 'em up 🔥
• --polver version — specify LCP policy version. Supported values are 2.0-2.4 (for TPM 1.2) and 3.0-3.2 (for TPM 2.0). If you don't specify it, this option defaults to 3.0. ✨

🦋 EXAMPLES 🦋

here's one, copy it, run it, feel powerful:

lcp2_crtpol --create --type list --pol list.pol --alg sha256 --data list.data --sign 0x8 list.lst

look at her go 😭💖

🌈 SEE ALSO 🌈

Full documentation of MLE, Intel(R) TXT and LCP is available in Intel(R) TXT Measured Launch Environment Deleveloper's Guide, available at:

http://www.intel.com/content/www/us/en/software-developers/intel-txt-software-development-guide.html

and also, go read your sisters:

• lcp2_crtpollist(8)
• lcp2_crtpolelt(8)
• lcp2_mlehash(8)

and that's the whole page, bestie!! 💖✨ this one came to you from tboot, dated 2020-05-10 — so yeah, it's giving vintage but make it slay. go make a policy, you got this. periodt. 🎀🦋💅🌈⭐👑🫶