Question: What is the function of tpm2-abrmd ？

[ChuanDou2021]

Keylime note:

Keylime by default (all versions after 6.2.0) uses the kernel TPM resource manager. For kernel versions older than 4.12 we recommend to use the tpm2-abrmd resource manager

Q1: If I use a higher version of the kernel (>=6.2.0), I don't need to install tpm2-abrmd，is that correct？
Q2: Is there a conflict between using a higher version kernel and installing tpm2-abrmd at the same time?

Thanks

[williamcroberts]

Q1: If I use a higher version of the kernel (>=6.2.0), I don't need to install tpm2-abrmd，is that correct？

Yes, unless you use features that the in-kernel resource manager doesn't support, like session un-gaping.

Q2: Is there a conflict between using a higher version kernel and installing tpm2-abrmd at the same time?

No, they work independently of each other and provide similar resource manager features.

Keylime directly opens /dev/tpmrm0 and sends commands to that, that rm in the name means resource manager. That is the in-kernel resource manager.

Clients that use tpm2-abrmd, connect to it over dbus, and then tpm2-tabrmd opens /dev/tpm0 which is the direct interface for the TPM which provides no resource manager functionality.

You, typically, want a resource manager between a client application and the TPM for a few reasons:

1. The TPM has limited resources, so:
   a. when a client exits, we want to clean up any TPM resources it was using to make them available
   b. If clients exceed TPM resources, we can essentially page things out to disk in a secure fashion, this is very similar in concept to memory paging
2. tpm2-abrmd doesn't support it yet, but you could add in finer grained access controls like what Windows TBS has
   a. You could integrate it with SE Linux, ebpf or build your own policy engine
   b. The in-kernel one could do the same, this isn't exclusive to tpm2-abrmd
3. Multi-client access. A resource manager allows clients to use the tpm as if they are the only ones using it seamlessly.

Let me know if this answers your question, sorry for the delay.