man7.org > Linux > man-pages

Linux/UNIX system programming training

systemd-report-sign-tsm@.service(8) — Linux manual page

NAME | SYNOPSIS | DESCRIPTION | SEE ALSO | COLOPHON 

SYSTEM...SERVICE(8)  systemd-report-sign-tsm@.service SYSTEM...SERVICE(8)

NAME         top

       systemd-report-sign-tsm@.service, systemd-report-sign-tsm.socket,
       systemd-report-sign-tsm - Sign system reports with a
       confidential-computing attestation report

SYNOPSIS         top

       systemd-report-sign-tsm@.service

       systemd-report-sign-tsm.socket

       /usr/lib/systemd/systemd-report-sign-tsm

DESCRIPTION         top

       systemd-report-sign-tsm@.service is a system service that signs
       system reports generated by systemd-report(1). It is a signing
       backend for the --sign= logic of that tool: it implements the
       io.systemd.Report.Signer.Sign() Varlink method and is reached via
       a socket linked into the /run/systemd/report.sign/ directory,
       named tsm.

       The service is socket-activated (one instance per connection) via
       systemd-report-sign-tsm.socket. Rather than signing with a local
       key, it obtains a hardware-backed attestation report from the
       platform's Trusted Security Module (TSM) through the kernel's
       configfs-TSM interface at /sys/kernel/config/tsm/report/. The
       digest passed to it is embedded into the report as its run-time
       provided data ("inblob"), cryptographically binding the
       attestation report to the system report being signed.

       The returned signature carries the binary attestation report (the
       "outblob"), the name of the TSM provider that generated it (for
       example "sev_guest" for AMD SEV-SNP or "tdx_guest" for Intel TDX),
       and, where the provider supplies them, supplemental certificate
       ("auxblob") and manifest ("manifestblob") data. A verifier selects
       the appropriate validation logic based on the provider field.

       This backend is only functional inside a confidential virtual
       machine whose kernel exposes the configfs-TSM interface (such as
       AMD SEV-SNP or Intel TDX guests). On systems where the interface
       is unavailable the signing operation is reported as unsupported
       and the mechanism is skipped. The service keeps no persistent
       state.

SEE ALSO         top

       systemd(1), systemd-report(1)

COLOPHON         top

       This page is part of the systemd (systemd system and service
       manager) project.  Information about the project can be found at
       ⟨http://www.freedesktop.org/wiki/Software/systemd⟩.  If you have a
       bug report for this manual page, see
       ⟨http://www.freedesktop.org/wiki/Software/systemd/#bugreports⟩.
       This page was obtained from the project's upstream Git repository
       ⟨https://github.com/systemd/systemd.git⟩ on 2026-08-04.  (At that
       time, the date of the most recent commit that was found in the
       repository was 2026-08-03.)  If you discover any rendering
       problems in this HTML version of the page, or you believe there is
       a better or more up-to-date source for the page, or you have
       corrections or improvements to the information in this COLOPHON
       (which is not part of the original manual page), send a mail to
       man-pages@man7.org

systemd 262~devel                                     SYSTEM...SERVICE(8)

Pages that refer to this page: systemd.directives(7),  systemd.index(7)

HTML rendering created 2026-09-09 by Michael Kerrisk, author of The Linux Programming Interface.

For details of in-depth Linux/UNIX system programming training courses that I teach, look here.

Hosting by jambit GmbH.

Cover of TLPI