kata-containers/s390-tools
1
0
Fork 0
mirror of https://github.com/ibm-s390-linux/s390-tools.git synced 2026-08-05 02:14:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

genprotimg: add support for add-secret requests

Browse Source 
IBM Secure Execution guests may want to share additional secrets with
the Ultravisor in a secure manner. For this the concept of secret
requests and three new Ultravisor-calls were introduced.

Add support to genprotimg to prepare an Secure Execution image with the
requirement that add-secret requests must provide an extension secret
that matches the customer communication key (CCK) derived extension
secret.

Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This commit is contained in:
Marc Hartmayer
2023-07-11 15:39:41 +00:00
committed by Jan Höppner
parent bc8a14895a
commit b7c9c2679e
6 changed files with 49 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
CHANGELOG.md
View File

@@ -8,6 +8,7 @@ Release history for s390-tools (MIT version)
Add new tools / libraries:
Changes of existing tools:
- genprotimg: add support for add-secret requests
Bug Fixes:

16
genprotimg/man/genprotimg.1
View File

@@ -97,9 +97,10 @@ Do not use for a production image unless you verified
the host-key document before. Optional.
.TP
\fB\-\-comm\-key\fR=\fI\,FILE\/\fR
Specifies the customer communication key (CCK). This key is used among
other things for the PV guest dump encryption. Use a secure, random,
plaintext AES-256 GCM key. Optional.
Specifies the customer communication key (CCK). This key is used for the
PV guest dump encryption and to derive the CCK-derived extension secret
used for add-secret requests. Use a secure, random, plaintext AES-256
GCM key. Optional.
.TP
\fB\-\-enable\-dump\fR
Enable PV guest dumps. Requires the \fB\-\-comm\-key\fR option. Optional.
@@ -107,6 +108,15 @@ Enable PV guest dumps. Requires the \fB\-\-comm\-key\fR option. Optional.
\fB\-\-disable\-dump\fR
Disable PV guest dumps. This is the default.
.TP
\fB\-\-enable\-cck\-extension\-secret\fR
Add-secret requests must provide an extension secret that matches the
CCK-derived extension secret. Requires the \fB\-\-comm\-key\fR option.
Optional.
.TP
\fB\-\-disable\-cck\-extension\-secret\fR
Add-secret requests don't have to provide an extension secret. This is
the default.
.TP
\fB\-\-enable\-pckmo\fR
Enable the support for the DEA, TDEA, AES, and ECC PCKMO key encryption
functions. This is the default.

4
genprotimg/src/include/pv_hdr_def.h
View File

@@ -34,6 +34,10 @@
#define PV_PCF_PCKMO_AES __PV_BIT(57) /* PCKMO encrypt-AES-key functions allowed */
#define PV_PCF_PCKM_ECC __PV_BIT(58) /* PCKMO encrypt-ECC-key functions allowed */
/* Secret control flags */
#define PV_SCF_CCK_EXTENSION_SECRET_ENFORCMENT \
__PV_BIT(1) /* All add-secret requests must provide an extension secret */
/* maxima for the PV version 1 */
#define PV_V1_IPIB_MAX_SIZE PAGE_SIZE
#define PV_V1_PV_HDR_MAX_SIZE (2 * PAGE_SIZE)

28
genprotimg/src/pv/pv_args.c
View File

@@ -75,6 +75,13 @@ static gint pv_args_validate_options(PvArgs *args, GError **err)
return -1;
}
if (cf_args->scf && !(cf_args->enable_cck_extension_secret_enforcement == PV_NOT_SET)) {
g_set_error(
err, PV_PARSE_ERROR, PV_PARSE_ERROR_SYNTAX,
_("The '--x-scf' option cannot be used with the '--(enable|disable)-extension-secret-required' flags.\nUse 'genprotimg --help' for more information"));
return -1;
}
/* Check for unused arguments */
if (args->unused_values->len > 0) {
g_autofree gchar *unused = NULL;
@@ -100,6 +107,14 @@ static gint pv_args_validate_options(PvArgs *args, GError **err)
"--help' for more information"));
return -1;
}
if (cf_args->enable_cck_extension_secret_enforcement == PV_TRUE &&
!args->cust_comm_key_path) {
g_set_error(
err, PV_PARSE_ERROR, PR_PARSE_ERROR_MISSING_ARGUMENT,
_("Option '--enable-cck-extension-secret' requires the '--comm-key' option.\nUse 'genprotimg "
"--help' for more information"));
return -1;
}
if (!args->output_path) {
g_set_error(err, PV_PARSE_ERROR, PR_PARSE_ERROR_MISSING_ARGUMENT,
@@ -254,11 +269,12 @@ static gboolean cb_remaining_values(const gchar *option G_GNUC_UNUSED,
.description = DISABLE_DESC, \
}
#define INDENT " "
#define INDENT " "
/* Define the callbacks for mutually exclusive command line flags */
DEFINE_MUT_EXCL_BOOL_FLAG_CBS(dump);
DEFINE_MUT_EXCL_BOOL_FLAG_CBS(pckmo);
DEFINE_MUT_EXCL_BOOL_FLAG_CBS(cck_extension_secret_enforcement);
gint pv_args_parse_options(PvArgs *args, gint *argc, gchar **argv[],
GError **err)
@@ -328,6 +344,14 @@ gint pv_args_parse_options(PvArgs *args, gint *argc, gchar **argv[],
_("Enable PV guest dumps (optional). This option\n" INDENT
"requires the '--comm-key' option."),
_("Disable PV guest dumps (default).")),
MUT_EXCL_BOOL_FLAG(
cck-extension-secret, cck_extension_secret_enforcement,
_("Add-secret requests must provide an extension\n" INDENT
"secret that matches the CCK-derived extension\n" INDENT
"secret (optional). This option requires the\n" INDENT
"'--comm-key' option."),
_("Add-secret requests don't have to provide\n" INDENT
"the CCK-derived extension secret (default).")),
MUT_EXCL_BOOL_FLAG(pckmo, pckmo,
_("Enable the support for the DEA, TDEA, AES, and\n" INDENT
"ECC PCKMO key encryption functions (default)."),
@@ -445,6 +469,8 @@ gint pv_args_parse_options(PvArgs *args, gint *argc, gchar **argv[],
.arg_data = cb_set_string_option,
.description = _("Specify the secret control flags\n" INDENT
"as a hexadecimal value.\n" INDENT
"Optional; mutually exclusive with\n" INDENT
"'--(enable|disable)-cck-extension-secret';\n" INDENT
"Optional; default: '0x0'."),
.arg_description = _("VALUE") },
{ 0 },

2
genprotimg/src/pv/pv_args.h
View File

@@ -33,6 +33,8 @@ STATIC_ASSERT(PV_NOT_SET == 0)
typedef struct {
gchar *pcf;
gchar *scf;
/* Add-secret requests do require CCK-extension secrets */
PvTristate enable_cck_extension_secret_enforcement;
PvTristate enable_dump;
PvTristate enable_pckmo;
} PvControlFlagsArgs;

2
genprotimg/src/pv/pv_image.c
View File

@@ -260,6 +260,8 @@ static gint pv_img_set_control_flags(PvImage *img, const PvControlFlagsArgs *cf_
img->scf = flags;
}
pv_img_set_control_flag(&img->scf, cf_args->enable_cck_extension_secret_enforcement,
PV_SCF_CCK_EXTENSION_SECRET_ENFORCMENT);
return 0;
}