From 17296a6b3acdc15899b193f18f4ad53a45411a6e Mon Sep 17 00:00:00 2001
From: Sergio Correia <scorreia@redhat.com>
Date: Fri, 4 Jul 2025 07:42:41 -0300
Subject: [PATCH] Populate cert_store_dir with tpmfiles.d

The TPM cert store is now deployed to /usr/share/keylime/tpm_cert_store
and we use tpmfiles.d to sync the content there to place where Keylime
will read the certificates from, /var/lib/keylime/tpm_cert_store.

Resolves: RHEL-76925

Signed-off-by: Sergio Correia <scorreia@redhat.com>
---
 keylime.spec     | 9 ++++++++-
 keylime.tmpfiles | 3 +++
 2 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/keylime.spec b/keylime.spec
index 955464f..faa293c 100644
--- a/keylime.spec
+++ b/keylime.spec
@@ -239,7 +239,12 @@ install -Dpm 644 ./services/%{srcname}_verifier.service \
 install -Dpm 644 ./services/%{srcname}_registrar.service \
     %{buildroot}%{_unitdir}/%{srcname}_registrar.service
 
-cp -r ./tpm_cert_store %{buildroot}%{_sharedstatedir}/%{srcname}/
+# TPM cert store is deployed to both /usr/share/keylime/tpm_cert_store
+# and then /var/lib/keylime/tpm_cert_store.
+for cert_store_dir in %{_datadir} %{_sharedstatedir}; do
+    mkdir -p %{buildroot}/"${cert_store_dir}"/%{srcname}
+    cp -r ./tpm_cert_store %{buildroot}/"${cert_store_dir}"/%{srcname}/
+done
 
 # Install the sysusers + tmpfiles.d configuration.
 install -p -D -m 0644 %{SOURCE2} %{buildroot}/%{_sysusersdir}/%{srcname}.conf
@@ -375,6 +380,8 @@ fi
 %config(noreplace) %verify(not md5 size mode mtime) %attr(400,%{srcname},%{srcname}) %{_sysconfdir}/%{srcname}/logging.conf
 %attr(700,%{srcname},%{srcname}) %dir %{_rundir}/%{srcname}
 %attr(700,%{srcname},%{srcname}) %dir %{_sharedstatedir}/%{srcname}
+%attr(500,%{srcname},%{srcname}) %dir %{_datadir}/%{srcname}/tpm_cert_store
+%attr(400,%{srcname},%{srcname}) %{_datadir}/%{srcname}/tpm_cert_store/*.pem
 %attr(500,%{srcname},%{srcname}) %dir %{_sharedstatedir}/%{srcname}/tpm_cert_store
 %attr(400,%{srcname},%{srcname}) %{_sharedstatedir}/%{srcname}/tpm_cert_store/*.pem
 %{_tmpfilesdir}/%{srcname}.conf
diff --git a/keylime.tmpfiles b/keylime.tmpfiles
index 698648e..e7a12a9 100644
--- a/keylime.tmpfiles
+++ b/keylime.tmpfiles
@@ -11,10 +11,13 @@ d /etc/keylime/tenant.conf.d 0500 keylime keylime -
 d /etc/keylime/agent.conf.d 0500 keylime keylime -
 
 # TPM certificate store.
+# Copy the cert store from /usr/share/keylime/cert_store_dir
+# to /var/lib/keylime/cert_store_dir.
 # Files inside /var/lib/keylime/tpm_cert_store/ have
 # 0400 permission and are owned by keylime/keylime,
 # while /var/lib/keylime/tpm_cert_store/ itself has
 # permission 0500, also owned by keylime/keylime.
+C /var/lib/keylime/tpm_cert_store 0500 keylime keylime - /usr/share/keylime/cert_store_dir
 Z /var/lib/keylime/tpm_cert_store 0400 keylime keylime -
 z /var/lib/keylime/tpm_cert_store 0500 keylime keylime -
 # Finally, /var/lib/keylime itself has 0700 permission,