postinst

#!/bin/sh

set -e

case "$1" in
    configure)
        # creating tss group if he isn't already there
        if ! getent group tss >/dev/null; then
            addgroup --system tss
        fi

        # creating tss user if he isn't already there
        if ! getent passwd tss >/dev/null; then
            adduser --system --ingroup tss --shell /bin/false \
                    --home /var/lib/tpm --no-create-home \
                    --gecos "TPM software stack" \
                    tss
        fi

        # creating keylime user if he isn't already there
        if ! getent passwd keylime >/dev/null; then
            adduser --system --ingroup tss --shell /bin/false \
                    --home /var/lib/keylime --no-create-home \
                    --gecos "Keylime remote attestation" \
                    keylime
        fi

        # Create keylime operational directory
	if [ ! -d /var/lib/keylime ]; then mkdir -p /var/lib/keylime/secure
	fi
        
	# Only root can mount tmpfs with `-o` 
        if ! grep -qs '/var/lib/keylime/secure ' /proc/mounts ; then mount -t tmpfs -o size=1m,mode=0700 tmpfs /var/lib/keylime/secure
	fi

        # Setting owner
        if [ -d /var/lib/keylime ] && getent passwd keylime >/dev/null; then
            chown -R keylime:tss /var/lib/keylime
        fi

	# The "keylime" user belongs to tss, and we need to give access to /sys/kernel/security/<x>
        if [ -d /sys/kernel/security/tpm0 ] ; then
            chown -R tss:tss /sys/kernel/security/tpm0
        fi

        if [ -d /sys/kernel/security/ima ] ; then
            chown -R tss:tss /sys/kernel/security/ima
        fi

#        # ask udev to check for new udev rules (and fix device permissions)
#        if udevadm --version > /dev/null; then
#            udevadm control --reload-rules ||:
#            udevadm trigger --sysname-match="tpm[0-9]*" ||:
#            udevadm trigger --action=add --subsystem-match=tpm ||:
#            udevadm trigger --action=add --subsystem-match=tpmrm ||:
#        fi
    ;;

    abort-upgrade|abort-remove|abort-deconfigure)
    ;;

    *)
        echo "postinst called with unknown argument \`$1'" >&2
        exit 1
    ;;
esac