JSON files after creation

[JordanLBogdanov]

Hello team.

I need to create a read only system, and I was wondering: аre the JSON files read-only after creation, or do they change at some point after that?

I am talking about the ones in: /usr/local/var/lib/tpm2-tss/system/keystore/*

P.S.
The only thing we do with the TPM chip, for now, is to create some indexes in the NVRAM before making the OS read-only.
After that we only read and write information to the TPM's NVRAM.

Thanks.

[JuergenReppSIT]

Currently the JSON file of a NV object in the keystore is updated after every write operation. This is actually unnecessary after the first write operation. The content of the file will only be changed after the first write because the NV_WRITTEN bit is set. I could create a PR where the keystore is updated only after the first write? So you could call a dummy write after the object creation before making the OS read-only.
If the auth value of the NV index is changed also a write to the keystore is currently executed.