kata-containers/s390-tools
1
0
Fork 0
mirror of https://github.com/ibm-s390-linux/s390-tools.git synced 2026-08-05 02:14:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

rust/pvimg: Add '--cck <FILE>' command line option and make '--comm-key' an alias

Browse Source 
Add '--cck <FILE>' as an command line option and make '--comm-key' an
alias of it. This makes the command line more similar to the other
Secure Execution related PV-tools (e.g. pvattest and pvsecret).

Suggested-by: Reinhard Bündgen <buendgen@de.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This commit is contained in:
Marc Hartmayer
2024-12-12 20:19:56 +01:00
committed by Jan Höppner
parent b1fdbac5f9
commit 5b6d7a467d
4 changed files with 19 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
rust/pvimg/man/genprotimg.1
View File

@@ -3,7 +3,7 @@
.\" it under the terms of the MIT license. See LICENSE for details. .\" it under the terms of the MIT license. See LICENSE for details.
.\" .\"
.TH genprotimg 1 "2024-12-12" "s390-tools" "Genprotimg Manual" .TH genprotimg 1 "2024-12-17" "s390-tools" "Genprotimg Manual"
.nh .nh
.ad l .ad l
.SH NAME .SH NAME
@@ -123,7 +123,7 @@ Overwrite an existing Secure Execution boot image.
.RE .RE
.RE .RE
.PP .PP
\-\-comm\-key <FILE> \-\-cck, \-\-comm\-key <FILE>
.RS 4 .RS 4
Use the content of FILE as the customer\-communication key (CCK). The file must Use the content of FILE as the customer\-communication key (CCK). The file must
contain exactly 32 bytes of data. contain exactly 32 bytes of data.
@@ -133,7 +133,7 @@ contain exactly 32 bytes of data.
\-\-enable\-dump \-\-enable\-dump
.RS 4 .RS 4
Enable Secure Execution guest dump support. This option requires the Enable Secure Execution guest dump support. This option requires the
\fB\-\-comm\-key\fR option. \fB\-\-cck\fR option.
.RE .RE
.RE .RE
.PP .PP
@@ -146,8 +146,7 @@ Disable Secure Execution guest dump support (default).
\-\-enable\-cck\-extension\-secret \-\-enable\-cck\-extension\-secret
.RS 4 .RS 4
Add\-secret requests must provide an extension secret that matches the Add\-secret requests must provide an extension secret that matches the
CCK\-derived extension secret. This option requires the \fB\-\-comm\-key\fR CCK\-derived extension secret. This option requires the \fB\-\-cck\fR option.
option.
.RE .RE
.RE .RE
.PP .PP
@@ -268,7 +267,7 @@ Generate an IBM Secure Execution image:
Generate an IBM Secure Execution image with Secure Execution guest dump support: Generate an IBM Secure Execution image with Secure Execution guest dump support:
.PP .PP
.B genprotimg \-i \fI\,/boot/vmlinuz\/\fR \-r \fI\,/boot/initrd.img\/\fR \-p \fI\,parmfile\/\fR \-k \fI\,host_key.crt\/\fR \-C \fI\,ibm-z-host-key-signing.crt\/\fR \-C \fI\,DigiCertCA.crt\fR \-o \fI\,/boot/secure-linux\/\fR \-\-enable\-dump \-\-comm\-key \fI\,comm-key\fR .B genprotimg \-i \fI\,/boot/vmlinuz\/\fR \-r \fI\,/boot/initrd.img\/\fR \-p \fI\,parmfile\/\fR \-k \fI\,host_key.crt\/\fR \-C \fI\,ibm-z-host-key-signing.crt\/\fR \-C \fI\,DigiCertCA.crt\fR \-o \fI\,/boot/secure-linux\/\fR \-\-enable\-dump \-\-cck \fI\,comm-key\fR
.SH NOTES .SH NOTES
.IP "1." 4 .IP "1." 4
The \fBgenprotimg\fR(1) command is a symbolic link to the \fBpvimg-create\fR(1) command. The \fBgenprotimg\fR(1) command is a symbolic link to the \fBpvimg-create\fR(1) command.

11
rust/pvimg/man/pvimg-create.1
View File

@@ -3,7 +3,7 @@
.\" it under the terms of the MIT license. See LICENSE for details. .\" it under the terms of the MIT license. See LICENSE for details.
.\" .\"
.TH pvimg-create 1 "2024-12-12" "s390-tools" "Pvimg Manual" .TH pvimg-create 1 "2024-12-17" "s390-tools" "Pvimg Manual"
.nh .nh
.ad l .ad l
.SH NAME .SH NAME
@@ -122,7 +122,7 @@ Overwrite an existing Secure Execution boot image.
.RE .RE
.RE .RE
.PP .PP
\-\-comm\-key <FILE> \-\-cck, \-\-comm\-key <FILE>
.RS 4 .RS 4
Use the content of FILE as the customer\-communication key (CCK). The file must Use the content of FILE as the customer\-communication key (CCK). The file must
contain exactly 32 bytes of data. contain exactly 32 bytes of data.
@@ -132,7 +132,7 @@ contain exactly 32 bytes of data.
\-\-enable\-dump \-\-enable\-dump
.RS 4 .RS 4
Enable Secure Execution guest dump support. This option requires the Enable Secure Execution guest dump support. This option requires the
\fB\-\-comm\-key\fR option. \fB\-\-cck\fR option.
.RE .RE
.RE .RE
.PP .PP
@@ -145,8 +145,7 @@ Disable Secure Execution guest dump support (default).
\-\-enable\-cck\-extension\-secret \-\-enable\-cck\-extension\-secret
.RS 4 .RS 4
Add\-secret requests must provide an extension secret that matches the Add\-secret requests must provide an extension secret that matches the
CCK\-derived extension secret. This option requires the \fB\-\-comm\-key\fR CCK\-derived extension secret. This option requires the \fB\-\-cck\fR option.
option.
.RE .RE
.RE .RE
.PP .PP
@@ -249,7 +248,7 @@ Generate an IBM Secure Execution image:
Generate an IBM Secure Execution image with Secure Execution guest dump support: Generate an IBM Secure Execution image with Secure Execution guest dump support:
.PP .PP
.B pvimg create \-i \fI\,/boot/vmlinuz\/\fR \-r \fI\,/boot/initrd.img\/\fR \-p \fI\,parmfile\/\fR \-k \fI\,host_key.crt\/\fR \-C \fI\,ibm-z-host-key-signing.crt\/\fR \-C \fI\,DigiCertCA.crt\fR \-o \fI\,/boot/secure-linux\/\fR \-\-enable\-dump \-\-comm\-key \fI\,comm-key\fR .B pvimg create \-i \fI\,/boot/vmlinuz\/\fR \-r \fI\,/boot/initrd.img\/\fR \-p \fI\,parmfile\/\fR \-k \fI\,host_key.crt\/\fR \-C \fI\,ibm-z-host-key-signing.crt\/\fR \-C \fI\,DigiCertCA.crt\fR \-o \fI\,/boot/secure-linux\/\fR \-\-enable\-dump \-\-cck \fI\,comm-key\fR
.SH NOTES .SH NOTES
.IP "1." 4 .IP "1." 4
The \fBgenprotimg\fR(1) command is a symbolic link to the \fBpvimg-create\fR(1) command. The \fBgenprotimg\fR(1) command is a symbolic link to the \fBpvimg-create\fR(1) command.

14
rust/pvimg/src/cli.rs
View File

@@ -96,8 +96,8 @@ pub struct ComponentPaths {
#[command(group(ArgGroup::new("header-flags").multiple(true).conflicts_with_all(["x_pcf", "x_scf"])))] #[command(group(ArgGroup::new("header-flags").multiple(true).conflicts_with_all(["x_pcf", "x_scf"])))]
pub struct CreateBootImageLegacyFlags { pub struct CreateBootImageLegacyFlags {
/// Enable Secure Execution guest dump support. This option requires the /// Enable Secure Execution guest dump support. This option requires the
/// '--comm-key' option. /// '--cck' option.
#[arg(long, action = clap::ArgAction::SetTrue, requires="comm_key", group="header-flags")] #[arg(long, action = clap::ArgAction::SetTrue, requires="cck", group="header-flags")]
pub enable_dump: Option<bool>, pub enable_dump: Option<bool>,
/// Disable Secure Execution guest dump support (default). /// Disable Secure Execution guest dump support (default).
@@ -105,9 +105,9 @@ pub struct CreateBootImageLegacyFlags {
pub disable_dump: Option<bool>, pub disable_dump: Option<bool>,
/// Add-secret requests must provide an extension secret that matches the /// Add-secret requests must provide an extension secret that matches the
/// CCK-derived extension secret. This option requires the '--comm-key' /// CCK-derived extension secret. This option requires the '--cck'
/// option. /// option.
#[arg(long, action = clap::ArgAction::SetTrue, requires="comm_key", group="header-flags")] #[arg(long, action = clap::ArgAction::SetTrue, requires="cck", group="header-flags")]
pub enable_cck_extension_secret: Option<bool>, pub enable_cck_extension_secret: Option<bool>,
/// Add-secret requests don't have to provide the CCK-derived extension /// Add-secret requests don't have to provide the CCK-derived extension
@@ -328,8 +328,8 @@ pub struct CreateBootImageArgs {
/// Use the content of FILE as the customer-communication key (CCK). /// Use the content of FILE as the customer-communication key (CCK).
/// ///
/// The file must contain exactly 32 bytes of data. /// The file must contain exactly 32 bytes of data.
#[arg(long, value_name = "FILE")] #[arg(long, value_name = "FILE", visible_alias = "comm-key")]
pub comm_key: Option<PathBuf>, pub cck: Option<PathBuf>,
#[clap(flatten)] #[clap(flatten)]
pub legacy_flags: CreateBootImageLegacyFlags, pub legacy_flags: CreateBootImageLegacyFlags,
@@ -481,6 +481,8 @@ mod test {
flat_map_collect(insert(mvca.clone(), vec![CliOption::new("parmfile", ["--parmfile", "/dev/null"])])), flat_map_collect(insert(mvca.clone(), vec![CliOption::new("parmfile", ["--parmfile", "/dev/null"])])),
flat_map_collect(insert(mvca.clone(), vec![CliOption::new("enable-dump", ["--enable-dump"]), flat_map_collect(insert(mvca.clone(), vec![CliOption::new("enable-dump", ["--enable-dump"]),
CliOption::new("comm-key", ["--comm-key", "/dev/null"])])), CliOption::new("comm-key", ["--comm-key", "/dev/null"])])),
flat_map_collect(insert(mvca.clone(), vec![CliOption::new("enable-dump", ["--enable-dump"]),
CliOption::new("comm-key", ["--cck", "/dev/null"])])),
flat_map_collect(insert(mvca.clone(), vec![CliOption::new("enable-dump", ["--enable-dump"]), flat_map_collect(insert(mvca.clone(), vec![CliOption::new("enable-dump", ["--enable-dump"]),
CliOption::new("comm-key", ["--comm-key", "/dev/null"])])), CliOption::new("comm-key", ["--comm-key", "/dev/null"])])),
flat_map_collect(insert(mvca.clone(), vec![CliOption::new("x-pcf", ["--x-pcf", "0x0"]), flat_map_collect(insert(mvca.clone(), vec![CliOption::new("x-pcf", ["--x-pcf", "0x0"]),

3
rust/pvimg/src/cmd/create.rs
View File

@@ -137,8 +137,7 @@ pub fn create(opt: &CreateBootImageArgs) -> Result<OwnExitCode> {
let verified_host_keys = opt let verified_host_keys = opt
.certificate_args .certificate_args
.get_verified_hkds("Secure Execution image")?; .get_verified_hkds("Secure Execution image")?;
let user_provided_keys = let user_provided_keys = read_user_provided_keys(opt.cck.as_deref(), &opt.experimental_args)?;
read_user_provided_keys(opt.comm_key.as_deref(), &opt.experimental_args)?;
let (plaintext_flags, secret_flags) = parse_flags(opt)?; let (plaintext_flags, secret_flags) = parse_flags(opt)?;
if plaintext_flags.is_set(PcfV1::NoComponentEncryption) { if plaintext_flags.is_set(PcfV1::NoComponentEncryption) {