This answer applies to TPM2 (the principle should be similar for TPM1.2). First of all: your TPM is accessible via the following character devices.
/dev/tpm0
: direct access to TPM driver
/dev/tpmrm0
: access to the TPM driver via the in-kernel TPM resource manager (recommended)
You can of course change the read/write permissions of those files temporarily. What you actually want to do, however, is create a udev
rule. That's basically a file in /etc/udev/rules.d/
. For reference, have a look at the udev rules provided by the TSS:
# tpm devices can only be accessed by the tss user but the tss
# group members can access tpmrm devices
KERNEL=="tpm[0-9]*", MODE="0660", OWNER="tss"
KERNEL=="tpmrm[0-9]*", MODE="0660", OWNER="tss", GROUP="tss"
As you can see, there is a rule for the user tss
. This user is dedicated for the userspace resource manager. If you use this resource manager, you will not have to access the files by yourself anymore, but the userspace resource manager will do it for you. Hence you do not need root permissions anymore. The userspace resource manager will run as service (or started manually as user tss
).