swtpm_setup.conf(8)

✨ swtpm_setup.conf(8) ✨

okay bestie so this is the swtpm_setup.conf manual page 💖 — the whole vibe here is "configuration file for swtpm_setup", and yes we're gonna walk through every single keyword together, no skips, no cap.

---

🌸 NAME 🌸

swtpm_setup.conf — Configuration file for swtpm_setup

---

🎀 DESCRIPTION 🎀

So like, the file /etc/swtpm_setup.conf holds all the configuration info for swtpm_setup. The rules are super strict bestie: it must only contain one configuration keyword per line, then an equals sign (=), and then the appropriate configuration information. And if you wanna drop a lil comment at the end of a line, you do that with a hash (#) sign. 💅

You can also write your own config into ${XDG_CONFIG_HOME}/swtpm_setup.conf, or — if XDG_CONFIG_HOME isn't set — it can live at ${HOME}/.config/swtpm_setup.conf. main character energy, your own personal config 🫶

Here are the keywords that are recognized, bestie:

• create_certs_tool — This keyword gets followed by the name of an executable or executable script that's used for creating various TPM certificates. That tool will be called with the following options:
  • --type type — This parameter indicates the type of certificate to create. The type parameter may be one of the following: ek, or platform.
  • --dir dir — This parameter indicates the directory into which the certificate is to be stored. It is expected that the EK certificate is stored in this directory under the name ek.cert and the platform certificate under the name platform.cert.
  • --ek ek — This parameter indicates the modulus of the public key of the endorsement key (EK). The public key is provided as a sequence of ASCII hex digits.
  • --vmid ID — This parameter indicates the ID of the VM for which to create the certificate.
  • --logfile <logfile> — The log file to log output to; by default logging goes to stdout and stderr on the console.
  • --configfile <configuration file> — The configuration file to use. This file typically contains configuration information for the invoked program. If omitted, the program must use its default configuration file.
  • --optsfile <options file> — The options file to use. This file typically contains options that the invoked program uses. If omitted, the program must use its default options file.
  • --tpm-spec-family <family>, --tpm-spec-level <level>, --tpm-spec-revision <revision> — These 3 options describe the TPM specification that was followed for the implementation of the TPM and will be part of the EK certificate. ✨
  • --tpm2 — This option is passed in case a TPM 2 compliant certificate needs to be created.
• create_certs_tool_config — This keyword gets followed by the name of a configuration file that will be passed to the invoked program using the --configfile option described above. If omitted, the invoked program will use the default configuration file.
• create_certs_tool_options — This keyword gets followed by the name of an options file that will be passed to the invoked program using the --optsfile option described above. If omitted, the invoked program will use the default options file.
• active_pcr_banks (since v0.7) — This keyword gets followed by a comma-separated list of names of PCR banks. The list must not contain any spaces. Valid PCR bank names are sha1, sha256, sha384, and sha512. 🧚

lowkey important: that PCR bank list literally cannot have spaces in it. the vibes must be comma-separated and tight, no stray gaps. 💀

---

🦋 SEE ALSO 🦋

• swtpm_setup

---

💜 REPORTING BUGS 💜

Found a bug? Report it to Stefan Berger <stefanb@linux.vnet.ibm.com> — he's the one holding it down fr fr. 🙈

---

okay that's the whole page, you absolutely ate that read-through 👑 this was the swtpm manual, dated 2024-11-08, and it's giving certified classic. go forth and configure, bestie 💖✨🌸🦋🎀💅