Initial Commit

2026-09-15 15:24:03 -04:00
commit 4dc7086e7e
605 changed files with 101380 additions and 0 deletions
@@ -0,0 +1,23 @@
+# Installed to /etc/apparmor.d/local/usr.bin.swtpm
+#
+# WHY THIS IS NEEDED
+#
+# Ubuntu ships an AppArmor profile for swtpm that permits libvirt's paths
+# and essentially nothing else: /run/libvirt/qemu/swtpm/*.sock,
+# /var/lib/libvirt/swtpm/**, and a couple of others. This suite does not
+# use libvirt, so a TPM socket under /run/owuivm was refused with
+# "Could not open UnixIO socket: Permission denied" - which reads like a
+# file-mode problem and is not one. Nothing appears in dmesg for it
+# either, because the profile denies quietly.
+#
+# Windows 11 will not install without a TPM, so this is the difference
+# between having a Windows machine and not.
+#
+# <local/...> is the profile's own documented extension point, so this
+# survives a swtpm package update in a way that editing the shipped
+# profile would not.
+#
+# Narrow on purpose: one directory, whose contents are per-session TPM
+# state that is thrown away with the session.
+owner /run/owuivm/** rwk,
+/run/owuivm/*/swtpm.sock rwk,