tpmlsm
A kernel protection tool that allows only approved executables to access Linux TPM devices
SITE CAPTUREBased on information published on the service's website. Selection and review policy
WHAT IT DOES
What does it do?
tpmlsm uses eBPF and BPF LSM to control access to /dev/tpm0 and /dev/tpmrm0. The allowlist checks both an executable's path and SHA-256 hash, so access is denied if the file's contents or location change. In monitoring mode, it records allowed and denied access attempts.
KEY FEATURES
Key features
- Denies TPM device access to programs outside the allowlist
- Checks approved executables by path and SHA-256 hash
- Applies access restrictions to programs running as root
- Records allowed and denied access attempts in monitoring mode