24 lines
994 B
Plaintext
24 lines
994 B
Plaintext
# Installed to /etc/apparmor.d/local/usr.bin.swtpm
|
|
#
|
|
# WHY THIS IS NEEDED
|
|
#
|
|
# Ubuntu ships an AppArmor profile for swtpm that permits libvirt's paths
|
|
# and essentially nothing else: /run/libvirt/qemu/swtpm/*.sock,
|
|
# /var/lib/libvirt/swtpm/**, and a couple of others. This suite does not
|
|
# use libvirt, so a TPM socket under /run/owuivm was refused with
|
|
# "Could not open UnixIO socket: Permission denied" - which reads like a
|
|
# file-mode problem and is not one. Nothing appears in dmesg for it
|
|
# either, because the profile denies quietly.
|
|
#
|
|
# Windows 11 will not install without a TPM, so this is the difference
|
|
# between having a Windows machine and not.
|
|
#
|
|
# <local/...> is the profile's own documented extension point, so this
|
|
# survives a swtpm package update in a way that editing the shipped
|
|
# profile would not.
|
|
#
|
|
# Narrow on purpose: one directory, whose contents are per-session TPM
|
|
# state that is thrown away with the session.
|
|
owner /run/owuivm/** rwk,
|
|
/run/owuivm/*/swtpm.sock rwk,
|