mirror of
https://github.com/ibm-s390-linux/s390-tools.git
synced 2026-08-05 02:14:52 +00:00
6a767408b3
pvics (PV Image Customization Support) is a comprehensive tool for converting existing qcow2 KVM guest images to IBM Secure Execution for Linux (SEL) images with Early Boot Customization (EBC) support and encrypted root filesystems. The tool provides four main actions: - list: Retrieve information about boot loader entries in a base image - convert: Convert a base image to an EBC-ready SEL image - encrypt: Encrypt the root filesystem and prepare EBC resources - full: Perform both conversion and encryption in one operation Assisted-by: IBM Bob:1.0.1 Reviewed-by: Holger Dengler <dengler@linux.ibm.com> Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com> Signed-off-by: Finn Callies <fcallies@linux.ibm.com> Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
106 lines
3.9 KiB
YAML
106 lines
3.9 KiB
YAML
# SPDX-License-Identifier: MIT
|
|
#
|
|
# Copyright IBM Corp.
|
|
|
|
|
|
# OPTIONAL (default: false)
|
|
no-verify: false
|
|
# This option controls whether the --no-verify flag is used with the pv commands.
|
|
|
|
# OPTIONAL (default: false)
|
|
no-ebc: false
|
|
# This option controls whether to trigger the SEL EBC related systemd units.
|
|
# It can be used to create a SEL guest image from an existing qcow2 image without utilizing SEL EBC.
|
|
# Setting this to true will prevent the encrypt action from running.
|
|
# In this case, the full action equals the convert action.
|
|
# Setting this to true will prevent the default pvimg options (see below) from being added and instead
|
|
# only add the user provided ones in .convert.pvimg-options.
|
|
|
|
# REQUIRED
|
|
out: data/output
|
|
# This specifies the local directory used for output.
|
|
|
|
# REQUIRED
|
|
hkds:
|
|
- data/*.hkd
|
|
# These are the paths to all relevant Host-Key-Documents.
|
|
# The paths may contain wildcard patterns.
|
|
|
|
# REQUIRED if .no-verify is false
|
|
# UNUSED if .no-verify is true
|
|
# This section contains all relevant files for verification of the certificate chain.
|
|
# See man pvsecret for more detailed information about any of the keys in this section.
|
|
certificate-chain:
|
|
# The paths may contain wildcard patterns.
|
|
certs:
|
|
- data/*.cert
|
|
|
|
# The paths may contain wildcard patterns.
|
|
crls:
|
|
- data/*.crl
|
|
|
|
# This is the pvsecret create offline option.
|
|
offline: true
|
|
|
|
# This is the root CA of the given certificates.
|
|
root-ca: data/root.ca
|
|
|
|
# This section contains relevant information for the first phase: conversion.
|
|
convert:
|
|
# REQUIRED
|
|
boot-loader-entry: boot_loader_entry_title
|
|
# This is the boot loader entry name to be used for kernel, initramfs and kernel parameter.
|
|
# You can list available boot loader entries with the list action.
|
|
|
|
# OPTIONAL
|
|
sel-kernel-parameter: swiotlb=524288
|
|
# These are additional kernel parameters for the resulting SEL image.
|
|
# The parameter rd.sel-ebc will always be added.
|
|
|
|
# OPTIONAL (default: --enable-pckmo-hmac)
|
|
pvimg-create-options: --enable-pckmo-hmac
|
|
# These are additional pvimg options for the resulting SEL image.
|
|
# The options --disable-image-encryption and --enable-update-cck are always used except when .no-ebc is true.
|
|
|
|
# This section contains relevant information for the second phase: encryption.
|
|
encrypt:
|
|
# OPTIONAL
|
|
cck: data/cck.key
|
|
# This is the local path to the CCK.
|
|
# If none is supplied, one will be generated and written to .out/cck.key.
|
|
|
|
# OPTIONAL
|
|
extension-secret: data/extension.secret
|
|
# This is the local path to the extension secret for pvsecret create.
|
|
# This is REQUIRED if .encrypt.add-secret-requests is used.
|
|
# In this case, the extension secret must be the one from the supplied ASRs.
|
|
# If none is supplied, one will be generated and written to .out/extension.secret.
|
|
|
|
# OPTIONAL
|
|
luks-key: data/rfs.key
|
|
# This is the local path to the LUKS encryption key.
|
|
# If none is supplied, one will be generated and written to .out/rfs.key.
|
|
|
|
# OPTIONAL
|
|
luks-passphrase: data/passphrase
|
|
# This is the local path to a file containing the LUKS passphrase.
|
|
# If none is supplied, one will be generated and written to .out/passphrase.
|
|
|
|
# OPTIONAL (default: rfs-luks-key)
|
|
luks-key-asr-name: aes-xts-segment-key
|
|
# This is the name of the ASR containing the LUKS encryption key.
|
|
|
|
# OPTIONAL (default: depending on .encrypt.luks-key)
|
|
luks-key-size: 512
|
|
# This is the key size of the LUKS encryption key (256 or 512).
|
|
# If .encrypt.luks-key is supplied, this will default to a size depending on the key.
|
|
# Otherwise, this will default to 512 and generate a matching key.
|
|
# If this is supplied but no key is supplied, a key of the requested size will be generated.
|
|
|
|
# OPTIONAL
|
|
add-secret-requests:
|
|
- data/*.asr
|
|
# These are additional secrets to be added during boot.
|
|
# Using this will make .encrypt.extension-secret a required argument.
|
|
# The supplied extension secret and the extension secret of supplied ASRs must be the same.
|
|
# The paths may contain wildcard patterns. |