tcsd(8)

📦
version 0.3.15 · 3 versions
, in debian bookworm, debian trixie, ubuntu jammy, ubuntu noble, ubuntu questing, ubuntu resolute, ubuntu stonking

👑 tcsd(8) — TCG Software Stack 💅

okay bestie, welcome to the System Manager's Manual corner of the internet, because we are talking about tcsd(8) today and honestly? it's giving main character energy for your whole TPM setup. this is the TCG Software Stack, and she's iconic. let's go ✨

🦋 NAME 🦋

tcsd — the daemon that manages Trusted Computing resources. yes, a whole daemon, being the boss of the trusted stuff. slay.

🌸 SYNOPSIS 🌸

tcsd [-f] [-e] [-c <configfile> ] [-h]

that's it, that's the whole vibe check. four little flags and a dream 💖

✨ DESCRIPTION ✨

Trousers is an open-source TCG Software Stack (TSS), released under the BSD License. no cap, that's the licensing situation, respect it.

Trousers aims to be compliant with the current (1.1b) and upcoming (1.2) TSS specifications available from the Trusted Computing Group website: http://www.trustedcomputinggroup.org — go look, the specs are right there, iykyk 📚

so what even is tcsd? bestie. she is a user space daemon that should be (according to the TSS spec, so not me making stuff up) the only portal to the TPM device driver. like, the one and only door 🚪✨

at boot time, tcsd should be started, it should open the TPM device driver, and from that point on, all requests to the TPM should go through the TSS stack. all of them. every single one. no sneaking around the side of the building 🙈

and what does she actually do all day? the tcsd manages TPM resources and handles requests from TSP's both local and remote. local besties, remote besties, everyone gets served 🫶

now the flags, because you know i would never leave you hanging:

  • -f, --foreground — run the daemon in the foreground. no hiding in the background, she's out here visibly doing the work 💅
  • -e — attempt to connect to software TPMs over TCP. software TPMs!! over the network!! networking era 🌐
  • -c, --config <configfile> — use the provided configuration file rather than the default configuration file. your config, your rules, periodt.
  • -h, --help — display help message. when in doubt, ask for help, it's literally free 🎀

🔒 ACCESS CONTROL 🔒

okay so there are two types of access control for the tcsd, and you need to know about both or you're gonna have a bad time:

  1. access to the daemon's socket itself
  2. access to specific commands internal to the tcsd

access to the tcsd's port should be controlled by the system administrator using firewall rules. your firewall, your bouncer at the door 💪 if using iptables, the following rule will allow a specific host access to the tcsd:

# iptables -A INPUT -s $IP_ADDRESS -p tcp --destination-port 30003 -j ACCEPT

copy that, paste that, thank me later ✨

access to individual commands internal to the tcsd is configured by the tcsd configuration file's "remote_ops" directive. each function call in the TCS API is reachable by a unique ordinal. each labeled "remote op" actually defines a set of ordinals (usually more than one) necessary to accomplish the operation. so it's not one-to-one, it's a bundle, a little squad of ordinals working together 🫂

for example: the "random" operation enables the ordinals for opening and closing a context, calling TCS_StirRandom and TCS_GetRandom, as well as TCS_FreeMemory. see? a whole group chat just to get some randomness. iconic behaviour honestly 🎲

by default, connections from localhost will allow any ordinals. localhost gets the VIP treatment, that's just how it is 💜

💾 DATA FILES 💾

TSS applications have access to 2 different kinds of 'persistent' storage, and they are not the same, bestie, do not confuse them:

  • 'User' persistent storage — has the lifetime of that of the application using it and therefore is destroyed when an application exits. User PS is controlled by the TSP of the application. so: app leaves, storage leaves. she's ephemeral, she's a fleeting moment 🦋
  • 'System' persistent storage — is controlled by the TCS and stays valid across application lifetimes, tcsd restarts and system resets. data registered in system PS stays valid until an application requests that it be removed. this one persists, this one has staying power 👑

the file locations, because you're gonna want these:

  • User PS files are by default stored as /var/tpm/user.{pid}
  • the system PS file by default is /var/tpm/system.data

and one lil detail that matters: the system PS file is initially created when ownership of the TPM is first taken. so if you're wondering where it came from — that's the moment 🌱

⚙️ CONFIGURATION ⚙️

tcsd configuration is stored by default in /etc/tcsd.conf. that's the spot. that's the file. go read it 📖

🐛 DEBUG OUTPUT 🐛

if TrouSerS has been compiled with debugging enabled, the debugging output can be supressed by setting the TSS_DEBUG_OFF environment variable. one env var and the noise is gone. silence. peace. we love a quiet queen 🤫

(and yes, that's "supressed" spelled exactly how the original says it — i'm not fixing it, i'm respecting it 💅)

🔌 DEVICE DRIVERS 🔌

tcsd is compatible with:

so like, take your pick, both are valid, both are supported, we don't play favourites here 🌈

📜 CONFORMING TO 📜

tcsd conforms to the Trusted Computing Group Software Specification version 1.1 Golden. golden!! in the name!! she really said "standard compliant and shiny" ✨👑

👀 SEE ALSO 👀

go read the config manpage too, it's the sequel and it's necessary 💖

✍️ AUTHOR ✍️

Kent Yoder

🚨 REPORTING BUGS 🚨

Report bugs to <trousers-tech@lists.sf.net>

(be nice, be specific, include details, they're doing their best 🫶)

🌟 the cute sign-off 🌟

and that's the whole page, bestie!! this is tcsd(8) from TSS 1.1, dated 2005-03-15 — yes, a classic, vintage, still serving looks after all these years 💜 mwah, go take care of your TPM 🎀💖✨

📦 where this page comes from