When login in with EKMF Web, a bearer token is retrieved from EKMF Web
which is then used on subsequent requests to authenticate with EKMF Web.
Such a bearer token is valid for several minutes, thus no re-login is
required during that time. The bearer token contains a JSON Web Token
(JWT, see RFC7519).
Allow to check such a token if it is still valid, or already expired.
That way a client application can check the token before issuing the next
request, and re-login if needed.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The EKMFWeb client library provides functions to communicate
with an EKMF Web server via REST calls over HTTPS. EKMF Web stands
for IBM Enterprise Key Management Foundation - Web Edition and is
used to manage keys in an enterprise.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Allow to refresh or update a KMS-bound key in the repository.
The secure key is re-imported from the KMS, and optionally also
its properties are updates from the KMS.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Allow to import keys that exist in a key management system into the
repository. The key together with its properties is imported.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Allow to list the keys managed by a key management system. The keys
are displayed together with the key properties stored in the KMS.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
When removing a KMS-bound key from the local repository, call the
KMS plugin and let it perform an action in the KMS. Usually keys are
not removed from key management systems, instead the key state is
changed to non-active or similar.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
When key properties are changed with the 'change' command, also update
the key properties in the KMS, if the key is bound to a KMS. Do not
allow to change the associated APQNs for KMS bound keys. KMS bound keys
inherit the APQNs from the KMS plugin.
When a key is renamed in the repository, also update the key name
property in the KMS if the key is KMS bound.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Do not allow to convert a KMS bound key. The key type of a KMS
bound key is determined by what the KMS plugin supports, thus it
can not be converted.
Do only allow to copy a KMS bound key, if the '--local' option is
specified. The result of the copy is a local key, that is not bound
to a KMS.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
When a repository that is bound to a key management system, the
keys are generated by the key management system by default. To
generate a local key, add option '--local'.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add the following sub-commands for key management system plugin
handling:
- configure: Configure a KMS plugin
- reencipher: Re-encipher secure keys used by a KMS plugin
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Some commands requires additional options that are to be determined
by the KMS plugin. Add support to let the KMS plugin provide an
option vector per command, and add the options to the already existing
command options.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add command 'kms' and the following sub-commands of it to handle
key management system plugin binding and unbinding:
- plugins: List available/configured KMS plugins
- bind: Binds a KMS plugin to the repository
- unbind: Unbinds a KMS plugin from the repository
- info: Displays information about the currently bound KMS plugin
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
To support keys that are bound to a key management system (via a KMS
plugin) add new key properties that reflect this. Display if a key is
bound to a KMS with the 'zkey list' and 'zkey validate' commands.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add support to integrate external key management systems into zkey
by using a plugin concept. Add helper functions to load, bind, and
unbind a key management system plugin.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add support for sub-commands to zkey. Sub-commands allow to group a
set of commands within a sub command.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add the -fPIC option when building the libutil objects to generate
position-independent code, and allow them to be used in dynamically
loaded shared libraries.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Acked-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add description for coordinated read access to man page as well as some
editorial changes after ID review.
Signed-off-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
For data consistency it is essential that datasets are not modified by
z/OS applications during zdsfs access. This is currently ensured by
manually setting the device offline in z/OS before mounting it in Linux.
This patch improves the usability and data security by making this manual
step obsolete.
Before opening a dataset zdsfs will obtain an ENQ to mark it as in use for
z/OS and release the ENQ when closing the dataset.
A timer is set up that pings the z/OSMF REST services with the ENQ to
prevent it from a timeout after 10 minutes.
The behavior of zdsfs can be configured in a new config file or with new
command line options.
Signed-off-by: Stefan Haberland <sth@linux.ibm.com>
Reviewed-by: Niklas Schnelle <schnelle@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add library functions that allow to communicate with z/OSMF REST services
using libcurl.
Following three functions are added:
lzds_rest_get_enq()
to obtain an ENQ that will mark a dataset as in use to z/OS until
it is released again
lzds_rest_release_enq()
to release an ENQ and mark a dataset as no longer in use to z/OS
lzds_rest_ping()
to ping a z/OSMF REST server to check if it accessible
or to refresh an ENQ and prevent it from a timeout after 10 minutes
Signed-off-by: Stefan Haberland <sth@linux.ibm.com>
Reviewed-by: Niklas Schnelle <schnelle@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Stage 3 flags is a 64bit integer but function add_ipl_program
used a 32bit integer instead. Due to this bug
STAGE3_FLAG_SCSI and STAGE3_FLAG_KDUMP were not correctly set.
Fixes: 412d3e8c ("zipl: consolidate stage3_params structs and stage3 flags")
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
libpfm does not yet include counters introduced with z15 in a release.
cpacfstatsd now implements its own counter logic to become independent
of the slow release cycles of libpfm.
Reviewd-By: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewd-By: Harald Freudenberger <freude@de.ibm.com>
Signed-off-by: Juergen Christ <jchrist@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
+ remove outdated comment that the revocation list checking is not implemented
+ improve usage example
Reviewed-by: Viktor Mihajlovski <mihajlov@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
We cannot rely on what $SHELL says as it describes what the users
default shell is and not which kind of shell /bin/sh is. So instead of
checking the environment variable $SHELL, we can test whether the
environment variable $BASH is set. If this is the case, we can be
pretty sure that the script is executed by the bash shell.
This fixes the error on Ubuntu 20.04:
./check_hostkeydoc se-certs/host-key.crt se-certs/ibm-z-host-key-signing.crt -c se-certs/DigiCertCA.crt -r se-certs/ibm-z-host-key.crl
./check_hostkeydoc: 42: set: Illegal option -o pipefail
Reviewed-by: Viktor Mihajlovski <mihajlov@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Set the counter name for z15 counter numbered 265. It is either named
DFLT_CCERROR or DFLT_CCFINISH, depending on the linux version. The
counter was renamed from CCERROR to CCFINISH in linux version 5.8.
Check for existence of file /sys/devices/cpum_cf/events/DLFT_CCERROR.
f this file exists the counter is named DFLT_CCERROR else
DFLT_CCFINISH (only for z15), other machines do not have this counter.
Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Modern distributions do not provide the symlink /sbin/udevadm any more.
Use /usr/bin/udevadm instead for the example init script / systemd units.
Note that those are meant for example purpose and would need to be adjusted
by distributions, so no extra effort is taken to determine the actual
location of udevadm.
Signed-off-by: Gerald Schaefer <gerald.schaefer@de.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
When udevadm is going to be used, try to locate it
in $PATH and if it fails, try to locate it in well-known
binary paths.
Signed-off-by: Guevenc Guelce <guvenc@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Commit 86856f98db ("zipl: Make use of __noreturn macro") moved the
'noreturn' attribute from declaration to definition. With this the
compiler can no longer optimize when the function is called in a
separate source file. Move the attribute back to the declaration
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Function util_opt_init() build the option string for getopt_long().
If a command has been set via util_opt_set_command(), then util_opt_init()
must honor that command and only add those options that match the command,
or are command independent.
That way the same option can be used in different commands with different
flags and different argument settings. E.g. for command 'a' option '-x'
might require an argument, for command 'b' the same option '-x' might not
require an argument.
The behavior of util_opt_init() is unchanged if no command is set, and
also if different commands use the same option, but with the same flags
and argument settings. Currently only the zkey tools set a command, but
use unique options per command.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Acked-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Remove obsolete and unused constants for zcore memory
character devices '/sys/kernel/debug/zcore/mem' and
'/sys/kernel/debug/zcore/memmap'.
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Reviewed-by: Philipp Rudo <prudo@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Fix that a misleading BLS error message is printed in any case for missing
files.
The scan_check code in zipl already does proper error handling for missing
file. Remove the duplicated error handling from scan_check_bls and just use
the function to update the file with the target path if needed.
To indicate the intention of this function also rename it.
Fixes: #84
Signed-off-by: Stefan Haberland <sth@linux.ibm.com>
Reviewed-by: Tuan Hoang <tmhoang@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
When vmcp fails to execute a CP command with both error conditions
- response buffer is too small
- CP command failed
then the vmcp program exits with 'response buffer too small' indication.
However, an exit code indicating 'CP command failed' would be more
important in this case.
So change the vmcp exit code and return 'CP command failed' for above
error scenario.
Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
z15 architecture supports counters for ECC operations. We now add and evaluate
these counters on supported architectures. If ECC counters are not supported,
we simply print "unsupported" for ECC counter values.
Manpages adapted accordingly.
Signed-off-by: Juergen Christ <juergen.christ@ibm.com>
Reviewed-by: Harald Freudenberger <freude@linux.ibm.com>
Reviewed-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Hard-coding udevadm's location isn't robust enough - for instance,
Ubuntu 20.04 moved it to /usr/bin.
First see if we can reach it through $PATH, then fall back to hard-coded
locations that we know about.
Also when finally falling back to udevsettle, check that it exists.
Otherwise we end up throwing tons of "No such file or directory" error
messages at the user.
Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com>
Reviewed-by: Steffen Maier <maier@linux.ibm.com>
Reviewed-by: Fedor Loshakov <loshakov@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
