[tpm2] Re: How to initialize a used TPM2 module and thoughts on clevis

[Tim K <tpm2 at bitzap.e4ward.com>]

[-- Attachment #1: Type: text/plain, Size: 910 bytes --]

My goal is to automate a cron job that requires credentials by keeping the credentials in a file that is encrypted using TPM2 via clevis. I am fully aware this does not add much protection if someone gets access to the OS, it is just so credentials do not sit in plain text in a file on disk, just protected by file permissions and it somewhat protects me from accidentally sync'ing the file to cloud or to some other backup (the file would at least be encrypted).

In order to do this, I don't think I can password protect the TPM2 hierarchies, otherwise there would be no way to automate it, I'd have to put the TPM2 passwords in the script for clevis to use (assuming clevis adds the option or that I just call the tpm2_* commands myself).

Any other suggestions how to make this better? My original idea was to use systemd-creds but it is not available in systemd v249 that Ubuntu 22.04 LTS ships with.