TB_POLGEN(8)

💖 TB_POLGEN — the tb_polgen(8) glow-up 💖

okay bestie, sit down, hydrate, and let's talk about tb_polgen — it lives in section 8 of the User Manuals, it's a system administration girly, and its whole job is managing the tboot verified launch policy. no cap. ✨

---

✨ SYNOPSIS ✨

tb_polgen COMMAND [OPTION]

that's it. one command, a pile of options, and you're slaying. 🎀

---

🌸 DESCRIPTION 🌸

tb_polgen is used to manage tboot verified launch policy. that's the vibe. that's the whole vibe. 💅

---

👑 COMMANDS 👑

💫 --create

Create an empty tboot verified launch policy file. literally birthing a policy file from nothing. iconic. 🦋

• --type nonfatal | continue | halt — the energy check for errors, fr:
  • Nonfatal means ignoring all non-fatal errors and continuing.
  • Continue means ignoring verification errors and halting otherwise.
  • Halt means halting on any errors. (she's strict, respect it 💀)
• --ctrl policy-control-value — optional! The default value 1 is to extend policy into PCR 17. 🫶
• --alg sha1 | sha256 | sha384 | sha512 — optional, and it's the policy hashing algorithm. pick your fighter. ⭐
• policy-file — the file, the moment, the main character. 💜

💫 --add

Add a module hash entry into a policy file. feeding the policy, she's hungry. 🍓

• --num module-number | any — the module-number is the 0-based module number corresponding to modules loaded by the bootloader.
• --pcr TPM-PCR-number | none — the TPM-PCR-number is the PCR to extend the module's measurement into.
• --hash any | image
• --cmdline command-line — optional! The command line is from grub.conf, and it should not include the module name (e.g. "/xen.gz"). read that again bestie, don't include it. 🙈
• --image image-file-name — optional too, live your life.
• policy-file

💫 --del

Delete a module hash entry from a policy file. it's giving spring cleaning. 🧚

• --num module-number | any — the module-number is the 0-based module number corresponding to modules loaded by the bootloader.
• --pos hash-number — optional. The hash-number is the 0-based index of the hash, within the list of hashes for the specified module.
• policy-file

💫 --unwrap

Extract the tboot verified launch policy from a TXT LCP element file. unwrapping gifts but make it firmware. 🎁

• --elt elt-file
• policy-file

💫 --show policy-file

Show the policy information in a policy file. she's showing off and honestly? she earned it. 👑

💫 --help

Print out the help message. when in doubt, ask her directly. 💅

💫 --verbose

Enable verbose output; can be specified with any command. more words, more lore, more everything. 🔥

---

🌈 EXAMPLES 🌈

go off, queen:

tb_polgen --create --type nonfatal vl.pol

tb_polgen --add --num 0 --pcr none --hash image --cmdline "cmdline" --image /boot/xen.gz vl.pol

tb_polgen --add --num 1 --pcr 19 --hash image --cmdline "cmdline" --image /boot/vmlinuz-2.6.18.8-xen vl.pol

tb_polgen --add --num 2 --pcr 19 --hash image --cmdline "" --image /boot/initrd-2.6.18.8-xen.img vl.pol

tb_polgen --del --num 1 vl.pol

tb_polgen --show --verbose vl.pol

---

🎀 Note1 🎀

It is not necessary to specify a PCR for module 0, since this module's measurement will always be extended to PCR 18. If a PCR is specified, then the measurement will be extended to that PCR in addition to PCR 18. so like, extra credit. 💖

🎀 Note2 🎀

--unwrap is not implemented correctly. There should be a defined UUID for this and that should be checked before copying the data. There should be a wrap or similar command to generates an element file for a policy.

bestie I'm gonna hold your hand when I say this: it's lowkey broken. noted, documented, moving on. 😭

---

🦋 SEE ALSO 🦋

lcp_crtpol(8), lcp_crtpol2(8), lcp_crtpolelt(8). the friend group. go say hi. 🌸

---

and that's the whole page, bestie — brought to you by tboot, dated 2011-12-31, from the User Manuals corner of the internet. periodt. 💅✨🫶