LCP2_CRTPOLELT(8)

📦 version 20250417_1.11.10, in centos-stream 10, centos-stream 9, debian bookworm, debian trixie, fedora 43, fedora 44, nixos 26.05, opensuse-leap 16.0, ubuntu jammy, ubuntu noble, ubuntu questing

💖 LCP2_CRTPOLELT 💖

okay bestie, this is lcp2_crtpolelt from the User Manuals section 8, and she is literally the queen of making Intel(R) TXT policy elements ✨

🌸 NAME 🌸

lcp2_crtpolelt — create an Intel(R) TXT policy element of specified type.

🎀 SYNOPSIS 🎀

lcp2_crtpolelt COMMAND [ ELEMENT TYPE OPTIONS ] [OPTION]

🦋 DESCRIPTION 🦋

lcp_crtpolelt is used to create an Intel(R) TXT policy element of specified type. She supports LCP elements in both current and legacy formats, no cap: LCP_MLE_ELEMENT2, LCP_STM_ELEMENT2, LCP_PCONF_ELEMENT2, LCP_PCONF_ELEMENT, LCP_MLE_ELEMENT and LCP_CUSTOM_ELEMENT. The range?? Iconic. 💅

👑 COMMANDS 👑

  • --create --type type --out FILE [--ctrl pol_elt_ctr1] — create a policy element specified by the --type option.
    • --type type — type of element. Must be first option. See below for type strings and their options 👇
    • --out FILE — output file name
    • [--ctrl value] — PolEltControl field (hex or decimal)
  • --show file [FILE] — show a policy element
  • --version — show tool version
  • --verbose — enable verbose output; can be specified with any command
  • --help — print out the help message

✨ OPTIONS ✨

The --create command requires additional parameters depending on the element's type. Every type has her own lil personality, so let's meet them 🫶

🧚 mle2 [--minver ver] [--alg algorithm] file [file...]

  • --minver ver — minimum version of SINIT (hex or decimal)
  • --alg <sha1|sha256|sha386|sha512> — hash algorithm
  • file [file...] — one or more text files, each containing one or more MLE hashes (as text, one hash per line); Hash files can be created with lcp2_mlehash.

🌈 custom --uuid UUID file

  • --uuid UUID — UUID in format: {0xaabbccdd, 0xeeff, 0xgghh, 0xiijj, {0xkk 0xll, 0xmm, 0xnn, 0xoo, 0xpp}} or "--uuid tboot" to use default
  • file — file containing element data

🍓 sbios [--alg algorithm] file [file...]

  • --alg <sha1|sha256|sha386|sha512> — hash algorithm
  • file [file...] — one or more files containing one or more BIOS hashes (as text, one hash per line); the first hash in the first file will be the fallback hash

💜 stm [--alg algorithm] file [file...]

  • --alg <sha1|sha256|sha386|sha512> — hash algorithm
  • file [file...] — one or more text files, each containing one or more STM hashes (as text, one hash per line);

🔥 pconf2 --alg algorithm [--pcrN hash_value]

  • --alg <sha1|sha256|sha386|sha512> — PCR hash algorithm
  • --pcrN hash_value — PCR value for PCR #N, where 0 <= N <= 7.

⭐ mle [--minver ver] file [file...]

  • --minver ver — minimum version of SINIT (hex or decimal)
  • file [file...] — one or more text files, each containing one or more MLE SHA1 hashes (as text, one hash per line); Hash files can be created with lcp2_mlehash.

🎀 pconf file [file...]

one or more text files, each containing PCR information; Each file should have the following structure: first line should be: 'locality:<value>' followed by up to 8 lines, each representing one PCR (0 to 7) and its contents: e.g. Locality represents TPM's locality at release. It is a byte, of which bits 0 to 4 represent their respective locality (bit0 - locality0 and so on). Bits 5-7 are reserved and must be 0. Value must be at least 1 - locality0 selected, and at most 0x1F (all localities selected).

bestie pls read that pconf bit twice, the reserved bits are not a suggestion 💀

💅 EXAMPLES 💅

Create MLE element:

lcp2_crtpolelt --create --type mle --out mle.elt --ctrl 0x00 --alg sha256 --minver 0 mle_hash

Create PCONF2 element:

lcp2_crtpolelt --create --type pconf2 --out pconf2.elt --ctrl 0x00 --alg sha256 --pcr0 <PCR[0] hash> --pcr3 <PCR[3] hash>

Create PCONF element:

lcp2_crtpolelt --create --type pconf pcrInfo1.txt pcrInfo2.txt --out pconf2.elt --ctrl 0x00

🔍 SEE ALSO 🔍

Full documentation of MLE, Intel(R) TXT and LCP is available in Intel(R) TXT Measured Launch Environment Deleveloper's Guide, available at: http://www.intel.com/content/www/us/en/software-developers/intel-txt-software-development-guide.html

lcp2_crtpol(8), lcp2_mlehash(8), lcp2_crtpollist(8), uuidgen(1), tb_polgen(8).

and that's the whole page, bestie!! 🫶 this one's from tboot, dated 2020-05-10, and yes she's serving in the User Manuals section like the icon she is. go make some policy elements, ily 💖✨

📦 where this page comes from