Subversion Repositories configs

#

# This is the configuration file for the trousers tcsd. (The Trusted Computing

# Software Stack Core Services Daemon).

#

# Defaults are listed below, commented out

#

# Send questions to: trousers-users@lists.sourceforge.net

#

# Option: port

# Values: 1 - 65535

# Description: The port that the tcsd will listen on.

#

# port = 30003

#

# Option: num_threads

# Values: 1 - 65535

# Description: The number of threads that the tcsd will spawn internally.

#

# num_threads = 10

#

# Option: system_ps_file

# Values: Any absolute directory path

# Description: Path where the tcsd creates its persistent storage file.

#

# system_ps_file = /var/lib/tpm/system.data

#

# Option: firmware_log_file

# Values: Any absolute directory path

# Description: Path to the file containing the current firmware PCR event

#  log data. The interface to this log is usually provided by the TPM

#  device driver.

#

# firmware_log_file = /sys/kernel/security/tpm0/binary_bios_measurements

#

# Option: kernel_log_file

# Values: Any absolute directory path

# Description: Path to the file containing the current kernel PCR event

#  log data. By default, this data will be parsed in the format provided

#  by the Integrity Measurement Architecture LSM. See

#  http://sf.net/projects/linux-ima for more info on getting IMA.

#

#

# kernel_log_file = /sys/kernel/security/ima/binary_runtime_measurements

#

# Option: firmware_pcrs

# Values: PCR indices, separated by commas (no whitespace)

# Description: A list of PCR indices that are manipulated only by the system

#  firmware and therefore are not extended or logged by the TCSD.

#

# firmware_pcrs =

#

# Option: kernel_pcrs

# Values: PCR indices, separated by commas (no whitespace)

# Description: A list of PCR indices that are manipulated only by the kernel

#  and therefore are not extended or logged by the TCSD.

#

# kernel_pcrs =

#

# Option: platform_cred

# Values: Any absolute directory path (example: /path/to/platform.cert)

# Description: Path to the file containing your TPM's platform credential.

#  The platform credential may have been provided to you by your TPM

#  manufacturer. If so, set platform_cred to the path to the file on disk.

#  Whenever a new TPM identity is created, the credential will be used. See

#  Tspi_TPM_CollateIdentityRequest(3) for more information.

#

# platform_cred =

#

# Option: conformance_cred

# Values: Any absolute directory path (example: /path/to/conformance.cert)

# Description: Path to the file containing your TPM's conformance credential.

#  The conformance credential may have been provided to you by your TPM

#  manufacturer. If so, set conformance_cred to the path to the file on disk.

#  Whenever a new TPM identity is created, the credential will be used. See

#  Tspi_TPM_CollateIdentityRequest(3) for more information.

#

# conformance_cred =

#

# Option: endorsement_cred

# Values: Any absolute directory path (example: /path/to/endorsement.cert)

# Description: Path to the file containing your TPM's endorsement credential.

#  The endorsement credential may have been provided to you by your TPM

#  manufacturer. If so, set endorsement_cred to the path to the file on disk.

#  Whenever a new TPM identity is created, the credential will be used. See

#  Tspi_TPM_CollateIdentityRequest(3) for more information.

#

# endorsement_cred =

#

# Option: remote_ops

# Values: TCS operation names, separated by commas (no whitespace)

# Description: A list of TCS commands which will be allowed to be executed

#  on this machine's TCSD by TSP's on non-local hosts (over the internet).

#  By default, access to all operations is denied.

#

# possible values:  seal - encrypt data bound to PCR values

#		    unseal - decrypt data bound to PCR values

#		    registerkey - store keys in system persistent storage [Disk write access!]

#		    unregisterkey - remove keys from system persistent storage [Disk write access!]

#		    loadkey - load a key into the TPM

#		    createkey - create a key using the TPM

#		    sign - encrypt data using a private key

#		    random - generate random numbers

#		    getcapability - query the TCS/TPM for its capabilities

#		    unbind - decrypt data

#		    quote - request a signed blob containing all PCR values

#		    readpubek - access the TPM's Public EndorsementKey

#		    getregisteredkeybypublicinfo - Search system persistent storage for a public key

#		    getpubkey - Retrieve a loaded key's public data from inside the TPM

#		    selftest - execute selftest and test results ordinals

#

# remote_ops =

#

# Option: enforce_exclusive_transport

# Values: 0 or 1

# Description: When an application opens a transport session with the TPM, one

#  of the options available is an "exclusive" session, meaning that the TPM

#  will not execute any commands other than those coming through the transport

#  session for the lifetime of the session. The TCSD can choose to enforce this

#  option or not. By default, exclusive sessions are not enforced, since this

#  could allow for a denial of service to the TPM.

#

#  enforce_exclusive_transport = 0

#

# Option: host_platform_class

# Values: One of the TCG platform class specifications

#	PC_11 - PC Client System, version 1.1

#	PC_12 - PC Client System, version 1.2

#	PDA_12 - PDA System, version 1.2

#	SERVER_12 - Server System, version 1.2

#	MOBILE_12 - Mobile Phone System, version 1.2

#

# Description: This option determines the host platform (host the TCS system

# is running on) class, among those specified by the Trusted Computing group

# on https://www.trustedcomputinggroup.org/specs/. This class will be reported

# by the TCS daemon when an application queries it using the

# TSS_TCSCAP_PROP_HOST_PLATFORM sub-capability. The default is PC_12.

#

# host_platform_class = PC_12

#

# Option: all_platform_classes

# Values: TCG Platform class names, separated by commas (no whitespaces)

#	PC_11 - PC Client System, version 1.1

#	PC_12 - PC Client System, version 1.2

#	PDA_12 - PDA System, version 1.2

#	SERVER_12 - Server System, version 1.2

#	MOBILE_12 - Mobile Phone System, version 1.2

#

# Description: This option determines all the platform classes supported by the

# TCS daemon. This list must not include the value set as "host_platform_class"

# specified above. Since by default TrouSerS supports all TPM 1.2 functionality,

# the default is all 1.2 and 1.1 platform classes.

#

# all_platform_classes = PC_11,PDA_12,SERVER_12,MOBILE_12

#

#

# Option: disable_ipv4

# Values: 0 or 1

# Description: This options determines if the TCSD will bind itself to the

# machine's local IPv4 addresses in order to receive requisitions through

# its TCP port. Value of 1 disables IPv4 support, so clients cannot reach

# TCSD using that protocol.

#

#  disable_ipv4 = 0

#

#

# Option: disable_ipv6

# Values: 0 or 1

# Description: This options determines if the TCSD will bind itself to the

# machine's local IPv6 addresses in order to receive requisitions through

# its TCP port. Value of 1 disables IPv6 support, so clients cannot reach

# TCSD using that protocol.

#

#  disable_ipv6 = 0

#