Add 95ibm-sel-ebc dracut module for secure boot-time customization of
SEL guests.
Introduce the IBM SEL EBC dracut module (95ibm-sel-ebc) that enables
Early Boot Customization for SEL guests during the initramfs phase.
The module implements a critical security architecture to prevent
injection attacks: all EBC resources (.asr and .pol files) are copied from
/boot/sics (which resides in the qcow2 image on the host filesystem) to
/run/ibm-sel-ebc (a tmpfs/RAM-backed directory). Since guest RAM is
protected by the Ultravisor, this prevents malicious hosts from modifying
EBC resources during boot.
Systemd units and their purposes:
- ibm-sel-ebc.target: Groups all EBC-related units
- boot.mount: Mounts /dev/disk/by-label/boot to /boot
- ibm-sel-ebc-ensure-sics.service: Fallback to create /boot/sics/ if boot
partition mount fails (supports Kata VM scenarios)
- ibm-sel-ebc-pvebc.service: Main unit that copies EBC resources to RAM,
invokes pvebc tool to verify integrity and add ASRs to UV, retrieves
LUKS passphrase from UV secret store
- ibm-sel-ebc-override-crypttab.service: Replaces /etc/crypttab with
prepared IBM SEL EBC crypttab, reloads systemd daemon, starts cryptsetup
service
- ibm-sel-ebc-paes-enforce.service: Verifies root filesystem uses PAES
encryption to prevent root filesystem substitution attacks
All units write logs to /boot/sics/log for debugging, accessible even if
root filesystem fails to mount. Units are triggered by rd.ibm-sel-ebc
kernel parameter and only execute in initramfs
(ConditionPathExists=/etc/initrd-release).
Assisted-by: IBM Bob:1.0.1
Reviewed-by: Holger Dengler <dengler@linux.ibm.com>
Signed-off-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Finn Callies