LCP2_CRTPOLLIST(8)

💖 NAME 💖

lcp2_crtpollist — bestie, this is the tool that creates an Intel(R) TXT policy list. That's it, that's the whole job, and it does it flawlessly 💅

---

🎀 SYNOPSIS 🎀

lcp2_crtpollist COMMAND [OPTION]

---

✨ DESCRIPTION ✨

Okay so real talk: lcp2_crtpollist is used to create an Intel(R) TXT policy list. That's the vibe. She builds the list, she signs the list, she shows you the list. Main character energy fr fr 🫶

---

🌸 OPTIONS 🌸

• --create — Create a TXT policy list. The following options are available:
  • --listver ver — policy list version. Supported values are: 0x100 (legacy LCP_POLICY_LIST), 0x200, 0x201 (legacy LCP_POLICY_LIST2) and 0x300 (current LCP_POLICY_LIST2_1). Pick your fighter ✨
  • --out file — output file for policy list
  • [file]... — policy element files (created with the lcp2_crpolelt command).
• --sign — Sign a TXT policy list.
  • --sigalg <rsa|rsapss|ecdsa|sm2> — Signature algorithm. Lists version 0x100 only support rsa (rsa pkcs 1.5). Lists version 0x200 and 0x201 support rsa (rsa pkcs 1.5) and ecdsa. Lists version 0x300 support rsapss and ecdsa.
  • --hashalg <sha1|sha256|sha384|sha512|sm2> — Hash algorithm used for signing a list. Lists version 0x100 only support SHA1.
  • --pub file — Public key to use, must be in PEM format.
  • [--priv file] — Private key to use, must be in PEM format. This option is required unless you use the --nosig option.
  • [--rev counter] — Revocation counter value
  • [--nosig] — Don't add a SigBlock. This option is ignored if list is version 0x300.
  • --out file — Policy list file (input and output)
• --addsig — Add a signature. This option is ignored if list is version 0x300.
  • --sig file — File containing signature (big-endian)
  • --out file — Policy list file
• --show file — Show contents of a policy file
• --verify file — Verify policy version 0x300 file.
• --version — Show tool version.
• --help — Print out the tool's help message.
• --verbose — Enable verbose output; can be specified with any command.

Lowkey the --verbose flag is the one you can slap onto literally anything here. It's giving ✨universal✨.

---

🔥 EXAMPLES 🔥

Create unsigned policy list with MLE element:

lcp2_crtpollist --create --out list.lst mle.elt

Sign policy:

lcp2_crtpollist --sign --sigalg rsa --pub pubkey.pem --priv privkey.pem --out list.lst

Not me making a whole policy list in two commands 😭 so easy it's iconic.

---

👑 SEE ALSO 👑

Full documentation of MLE, Intel(R) TXT and LCP is available in Intel(R) TXT Measured Launch Environment Deleveloper's Guide, available at:

http://www.intel.com/content/www/us/en/software-developers/intel-txt-software-development-guide.html

• lcp2_crtpol(8), lcp2_crtpolelt(8), lcp2_mlehash(8), openssl(1).

---

And that's the whole page, bestie 🦋 this was brought to you by tboot, dated 2020-05-10 — go forth and create policy lists, you absolute legend 💜✨