| LCP_CRTPOLLIST(8) | User Manuals | LCP_CRTPOLLIST(8) |
NAME¶
lcp_crtpollist - create an Intel(R) TXT policy list
SYNOPSIS¶
lcp_crtpollist COMMAND [OPTION]
DESCRIPTION¶
lcp_crtpollist is used to create an Intel(R) TXT policy list.
OPTIONS¶
- --create
- Create an TXT policy list. The following options are available:
- --out file
- policy list file
- [--ver version]
- version
- [file]...
- policy element files
- --sigh
- Sign an TXT policy list.
- --pub key-file
- PEM file of public key
- --out file
- policy list file
- [--priv key-file]
- PEM file of private key
- [--rev rev-ctr]
- revocation counter value
- [--nosig]
- don't add SigBlock
- --sig file
- file containing signature (big-endian)
- --out file
- policy list file
- --show file
- policy list file
- --help
- Print out the help message.
- --verbose
- Enable verbose output; can be specified with any command.
EXAMPLES¶
Create policy list:¶
Assuming there have been two element file mle.elt and pconf.elt generated by lcp_crtpolelt(8) The following example can create an unsigned policy list:
lcp_crtpollist --create --out list-unsig.lst mle.elt pconf.elt
Sign policy list:¶
Unsigned policy list can be signed by the command lcp_crtpollist(8) or openssl(1). The openssl(1) signing is supported for cases where the signing environment is separate from the policy creation environment and the software allowed to run there is strictly controlled and already supports openssl(1).
The following example uses openssl(1) to sign the list:
| 1 | openssl rsa -pubout -in privkey.pem -out pubkey.pem |
| 2 | cp list-unsig.lst list-sig.lst |
| 3 | lcp_crtpollist --sigh --pub pubkey.pem --nosig --out list-sig.lst |
| 4 | openssl genrsa -out privkey.pem 2048 |
| 5 | openssl dgst -sha1 -sign privkey.pem -out list.sig list-sig.lst |
| 6 | lcp_crtpollist --addsig --sig list.sig --out list-sig.lst |
lcp_crtpollist can also be used to sigh a policy list. The following example are intended to be mutually exclusive with the preceding example.
| 1 | openssl genrsa -out privkey.pem 2048 |
| 2 | openssl rsa -pubout -in privkey.pem -out pubkey.pem |
| 3 | cp list-unsig.lst list-sig.lst |
| 4 | lcp_crtpollist --sign --pub pubkey.pem --priv privkey.pem --out list-sig.lst |
SEE ALSO¶
lcp_crtpol2(8), lcp_crtpolelt(8), lcp_crtpollist(8), openssl(1).
| 2011-12-31 | tboot |