kata-containers/s390-tools
1
0
Fork 0
mirror of https://github.com/ibm-s390-linux/s390-tools.git synced 2026-08-05 02:14:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

pvattest/tools: Add tool for attestation

Browse Source 
Adds:
  * extract_hdr_from_image
    a bash script to extract the SE header from an SE image.

Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Acked-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This commit is contained in:
Steffen Eiden
2022-06-01 08:00:24 +00:00
committed by Jan Höppner
parent 3ab06d77fb
commit 26148740df
4 changed files with 96 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
.gitignore vendored
View File

@@ -69,6 +69,7 @@ mon_tools/mon_fsstatd
mon_tools/mon_procd
osasnmpd/osasnmpd
pvattest/src/pvattest
pvattest/tools/exchange_info
qetharp/qetharp
qethqoat/qethqoat
systemd/cpacfstatsd.service

2
pvattest/Makefile
View File

@@ -4,7 +4,7 @@ include ../common.mak
.DEFAULT_GOAL := all
PKGDATADIR := "$(DESTDIR)$(TOOLS_DATADIR)/pvattest"
SUBDIRS := src man
SUBDIRS := src man tools
RECURSIVE_TARGETS := all-recursive clean-recursive install-recursive
all: all-recursive

5
pvattest/tools/Makefile Normal file
View File

@@ -0,0 +1,5 @@
include ../../common.mak
install:
$(INSTALL) -d -m 755 $(DESTDIR)$(USRBINDIR)
$(INSTALL) -g $(GROUP) -o $(OWNER) -m 755 pvextract-hdr "$(DESTDIR)$(USRBINDIR)"

89
pvattest/tools/pvextract-hdr Executable file
View File

@@ -0,0 +1,89 @@
#!/bin/bash
#
# pvextract_hdr - extract an IBM Secure Execution header from the Image
#
# Sample:
# ./pvextract-hdr -o sehdr.bin se-image.bin
#
# Copyright IBM Corp. 2022
#
# s390-tools is free software; you can redistribute it and/or modify
# it under the terms of the MIT license. See LICENSE for details.
set -o pipefail
set -o nounset
set -e
def_output="sehdr.bin"
def_skip=0x14
def_len=0x4
usage() {
cat <<-EOF
Usage: $(basename "$0") [-o ${def_output}] [-s ${def_skip}] [-l ${def_len}] FILE
Extract the header of the SE-image located in FILE.
By default ${def_skip} pages will be skipped until starting to search
for the header. By default the search will be stopped after ${def_len} pages.
'${def_output}' is the default output file name.
EOF
}
function check_file() {
[ -e "$1" ] ||
{ echo "ERROR: File '$1' not found" >&2 && exit 1; }
}
function check_hdr_ver() {
local hdr_start="$1"
local input="$2"
xxd -s $((hdr_start + 8)) -l 4 "$input" | grep -q "000 0100" ||
{ echo -n "WARNING: unknown hdr version " &&
xxd -s $((hdr_start + 8)) -l 4 "$input" | awk '{print "0x" $2 $3}'; }
}
output=${def_output}
parsed_skip=${def_skip}
parsed_len=${def_len}
# the last argument must be the input file
input="${*: -1}"
while getopts 'o:s:l:h' OPTION; do
case "$OPTION" in
o) output="$OPTARG" ;;
s) parsed_skip="$OPTARG" ;;
l) parsed_len="$OPTARG" ;;
h)
usage
exit 0
;;
:)
echo "ERROR: Must supply an argument to -$OPTARG." >&2
exit 1
;;
*)
usage
exit 1
;;
esac
done
#argument specify pages; convert to bytes
skip=$((parsed_skip * 0x1000))
len=$((parsed_len * 0x1000))
if [ $# -eq 0 ]; then
echo "ERROR: Input not set. Use '$(basename "$0") [FILE]' to specify the Input file" >&2
exit 1
fi
check_file "$input"
hdr_start=$(xxd -s $((skip)) -l $((len)) "${input}" | grep IBMSecEx || { echo ERROR: "${input} does not contain an SE header." >&2 && exit 1; })
hdr_start=$(echo "${hdr_start}" | awk '{print "0x" $1}' | cut -c 1-10)
echo "SE header found at offset ${hdr_start}"
check_hdr_ver "$hdr_start" "$input"
size=$(xxd -s $((hdr_start + 12)) -l 4 "${input}" | awk 'NR==1 {print "0x" $2 $3}')
dd if="${input}" of="${output}" bs=1 count=$((size)) skip=$((hdr_start)) status=none
echo "SE header written to '${output}' ($((size)) bytes)"