[EPIC-02] TPM2.0 storage layer #2

New issue

Closed

opened 2026-07-26 23:17:33 +02:00 by elegos · 0 comments

elegos commented

2026-07-26 23:17:33 +02:00

Owner

Per-user sealed enrollment DB and trust policy sealed blob.

Scope

Key wrapping mode (default) + PCR sealing opt-in
Per-user enrollment.db at users/<uid>/enrollment.db
PCR sealing: users/<uid>/sealed/<kernel-ver>.blob
Auto re-seal via kernel-install hook (all users, system-wide)
linux-hello-tpm reseal CLI
DatabaseError signal with error_code: tpm_not_found, tpm_replaced, pcr_mismatch, db_corrupt
Kernel keyring for decryption key (never in process memory)

Per-user sealed enrollment DB and trust policy sealed blob. ## Scope - Key wrapping mode (default) + PCR sealing opt-in - Per-user `enrollment.db` at `users/<uid>/enrollment.db` - PCR sealing: `users/<uid>/sealed/<kernel-ver>.blob` - Auto re-seal via `kernel-install` hook (all users, system-wide) - `linux-hello-tpm reseal` CLI - `DatabaseError` signal with `error_code`: `tpm_not_found`, `tpm_replaced`, `pcr_mismatch`, `db_corrupt` - Kernel keyring for decryption key (never in process memory)

elegos added this to the EPIC-02 milestone

2026-07-26 23:17:33 +02:00

elegos added the

epic

area: tpm

labels

2026-07-26 23:17:33 +02:00

elegos added this to the Foundation project

2026-07-26 23:21:30 +02:00

elegos closed this issue

2026-07-28 12:22:52 +02:00