GENPROTIMG(8)

NAME
genprotimg - Create a protected virtualization image

SYNOPSIS
genprotimg -k HOST_KEY_DOCUMENT... -i VMLINUZ [-r RAMDISK] [-p PARMFILE] -o OUTFILE [OPTION]...

DESCRIPTION

Use genprotimg to generate a single bootable image file with encrypted and integrity-protected parts. The command requires a kernel image, a host-key document, and an output file name. Optionally, specify an initial RAM filesystem, and a file containing the kernel parameters. Should special circumstances require it, you can optionally specify your own keys for the encryption by using the experimental options. In the resulting image file, a plain text boot loader, the encrypted components for kernel, initial RAM disk, kernel parameters, and the encrypted and integrity-protected header are concatenated. The header contains metadata necessary for running the guest in protected mode.

Use this image file as a kernel image for zipl or for a direct kernel boot using QEMU.

OPTIONS

-h, --help
    Prints usage information, then exits.

--help-experimental
    Prints experimental usage information, then exits.

--help-all
    Prints all usage information, then exits.

-V, --verbose
    Provides more detailed output.

-k, --host-key-document=HOST_KEY_DOCUMENT
    Specifies a host-key document. At least one is required. Specify this option multiple times to enable the image to run on more than one host.

-o, --output=OUTPUT_FILE
    Specifies the output file. Required.

-i, --image=VMLINUZ
    Specifies the Linux kernel image file. Required.

-r, --ramdisk=RAMDISK
    Specifies the RAM disk image. Optional.

-p, --parmfile=PARMFILE
    Specifies the kernel command line stored in PARMFILE. Optional.

--no-verify
    Do not require the host-key documents to be valid. For testing purposes, do not use for a production image. Optional.

-v, --version
    Prints version information, then exits.

EXAMPLE

Generate a protected virtualization image in /boot/vmlinuz.pv, using the kernel file vmlinuz, the initrd in initramfs, the kernel parameters contained in parmfile, and the host-key document in host_key.crt:

            genprotimg -i vmlinuz -r initramfs -p parmfile -k host_key.crt -o /boot/vmlinuz.pv

NOTES

1.  An ELF file cannot be used as a Linux kernel image.

2.  Remember to re-run zipl after updating a protected virtualization image.

SEE ALSO
zipl(5), qemu(1)