diff --git a/sbin/devd/devd.conf b/sbin/devd/devd.conf
--- a/sbin/devd/devd.conf
+++ b/sbin/devd/devd.conf
@@ -150,6 +150,13 @@
 
 	action "service moused stop $cdev";
 };
+notify 100 {
+	match "system" "DEVFS";
+	match "subsystem" "CDEV";
+	match "type" "CREATE";
+	match "cdev" "tpm0";
+	action "/usr/sbin/chown root:_tss /dev/tpm0; /bin/chmod 660 /dev/tpm0";
+};
 
 # Don't even try to second guess what to do about drivers that don't
 # match here.  Instead, pass it off to syslog.  Commented out for the