Some error information is displayed during the startup of the keylime agent.

[webfast7]

Whether I'm on a PC with TPM hardware or a PC with a TPM emulator, the keylime agent starts up with an error that seems to affect part of the keylime. When I tried to use the current master branch or an older version to try to bypass this error, I failed. I've tried keylime on both Arm64 and x86 machines. Hope to give me some help。

The configuration used is the default configuration, I've never changed the configuration, I want to try to use it.

[webfast7]

Let me add: on the TPM hardware machine
cpu:i5-8300H
System: ubuntu24

[THS-on]

This error is fine/expected when the TPM does not have an EK certificate in the NV index. This happens with e.g. certain Intel CPU TPMs and if you are using swtpm without provisioning the EK certificate.

We should probably try to find a way to suppress the raw errors from the TSS esapi.

[webfast7]

This error is fine/expected when the TPM does not have an EK certificate in the NV index. This happens with e.g. certain Intel CPU TPMs and if you are using swtpm without provisioning the EK certificate.

We should probably try to find a way to suppress the raw errors from the TSS esapi.

I tried to use https://github.com/stefanberger/swtpm/blob/v0.9.0/man/man8/swtpm_setup.pod swtpm to create an EK into the TPM, the problems also

The command used is
swtpm_setup --tpm2 --tpmstate ${XDG_CONFIG_HOME}/mytpm1
--create-ek-cert --create-platform-cert --lock-nvram

[THS-on]

Can you try this for setting up swtpm and if you run into errors please post the full logs of keylime and swtpm:

swtpm_setup --tpm2  --tpmstate ${XDG_CONFIG_HOME}/mytpm1  --createek --decryption --create-ek-cert --create-platform-cert   --pcr-banks sha1,sha256  --display

[webfast7]

Can you try this for setting up swtpm and if you run into errors please post the full logs of keylime and swtpm:

swtpm_setup --tpm2  --tpmstate ${XDG_CONFIG_HOME}/mytpm1  --createek --decryption --create-ek-cert --create-platform-cert   --pcr-banks sha1,sha256  --display

Thank you very much for your reply, I asked some technicians during this period to add the index of ek in a new way, and I have to say I had trouble again.

When I use this command. It prints some memory addresses, which are compliant with the TCG specification.

tpm2_getcap handles-nv-index
- 0x1C00002
- 0x1C00016
- 0x1C08000

When I try to get this value

tpm2_nvreadpublic 0x1c00002

0x1c00002:
  name: 000bb5d3a23a70e478f7e05c57e9157d9c0391150c5b99795828088f2c552060eb4f
  hash algorithm:
    friendly: sha256
    value: 0xB
  attributes:
    friendly: ppwrite|writelocked|writedefine|ppread|ownerread|authread|no_da|written|platformcreate
    value: 0x62072801
  size: 1016

This is from https://github.com/stefanberger/swtpm/blob/master/src/swtpm_setup/swtpm.c#L439

But there are some problems with the results I get in keylime.
I rewrote the configuration of agent.conf.
ek_handle = "0x1C00002"

The keylime_agent startup result is as follows:

 DEBUG keylime_agent::config > Environment configuration config=/etc/keylime/agent.conf
 WARN  keylime_agent         > Measured boot measurement list not available: /sys/kernel/security/tpm0/binary_bios_measurements
 DEBUG keylime_agent::secure_mount > Secure store location /var/lib/keylime/secure already mounted on tmpfs
 INFO  keylime_agent::permissions  > Changed file /var/lib/keylime/secure owner to keylime:tss.
 INFO  keylime_agent::permissions  > Dropped privileges to run as keylime:tss
 INFO  keylime_agent               > Running the service as keylime:tss...
 INFO  keylime_agent               > Starting server with API version v2.2...
 WARN  keylime_agent               > INSECURE: Keylime is currently using a software TPM emulator rather than a real hardware TPM.
 WARN  keylime_agent               > INSECURE: The security of Keylime is NOT linked to a hardware root of trust.
 WARN  keylime_agent               > INSECURE: Only use Keylime in this mode for testing or debugging purposes.
Error: Tpm(TSSNewPersistentHandleError { handle: "0x1C00002", source: WrapperError(InvalidParam) })

I tried to look at part of the rust code.The error message comes from https://github.com/parallaxsecond/rust-tss-esapi/blob/main/tss-esapi/src/handles/tpm.rs 115lines。It seems that this value is a definite value, and I'm not sure where I'm wrong.

[THS-on]

ek_handle is used if you have a persistent key handle, not for the certificate. 0x1C00002 is an NV index handle where the EK certificate is stored. As this is standardized there is nothing you need to configure. Can you set ek_handle back to generate and try again?

[webfast7]

ek_handle is used if you have a persistent key handle, not for the certificate. 0x1C00002 is an NV index handle where the EK certificate is stored. As this is standardized there is nothing you need to configure. Can you set ek_handle back to generate and try again?

this is error message
Failed to create EK object: WrapperError(InvalidParam)
Error: Tpm(Tss2 { err: WrapperError(InvalidParam), kind: None, message: "the provided parameter is invalid for that type." })

My remote debug ide has a problem, I can't go to the detailed location, very sorry, if fixed and new message, I will reply again.