1

Am Working on Trusted Platform Module(TPM) chip(Both TPM12 and TPM20). As of now am doing some operations on TPM such as, taking TPM ownership, Clearing TPM, Generating Keys inside TPM etc. But for all these operations i need sudo permission in my Linux laptop.

So can i do all above mentioned operations as a normal user without root permission? If yes how to access TPM without root permissions?

1 Answer 1

1

This answer applies to TPM2 (the principle should be similar for TPM1.2). First of all: your TPM is accessible via the following character devices.

  • /dev/tpm0: direct access to TPM driver
  • /dev/tpmrm0: access to the TPM driver via the in-kernel TPM resource manager (recommended)

You can of course change the read/write permissions of those files temporarily. What you actually want to do, however, is create a udev rule. That's basically a file in /etc/udev/rules.d/. For reference, have a look at the udev rules provided by the TSS:

# tpm devices can only be accessed by the tss user but the tss
# group members can access tpmrm devices
KERNEL=="tpm[0-9]*", MODE="0660", OWNER="tss"
KERNEL=="tpmrm[0-9]*", MODE="0660", OWNER="tss", GROUP="tss"

As you can see, there is a rule for the user tss. This user is dedicated for the userspace resource manager. If you use this resource manager, you will not have to access the files by yourself anymore, but the userspace resource manager will do it for you. Hence you do not need root permissions anymore. The userspace resource manager will run as service (or started manually as user tss).

2
  • Will these permissions remains same even after reebot? Because as i know if i apply any permissions using "chmod" then it will go off after reboot. Also is /etc is right path to define rules file?
    – Karma Yogi
    Nov 28, 2019 at 5:20
  • Yes, on my machine, manually set permission will be reset after reboot. The path may vary depending on you linux distro. If you need another reference: this article explains how to create a udev rule for opensuse.
    – MemAllox
    Nov 28, 2019 at 9:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .