when installing keylime on an existing RHEL image mode system, /user/share/keylime/tpm_cert_store may not be owned by keylime user/group.

dr-x------. 2 986 keylime 1341 Jan 1 1970 /usr/share/keylime/tpm_cert_store

this applies to /usr/libexec/keylime/ as well.

The problem is that these directories are under /usr which is read-only, therefore we cannot set the ownership through tpmfiles.d.

Seems that the content under /usr should be owned by root:root and permissions should be updated accordingly.
755 for /usr/libexec/keylime/
644 for /user/share/keylime/tpm_cert_store/*