mirror of
https://github.com/ibm-s390-linux/s390-tools.git
synced 2026-08-05 02:14:52 +00:00
Steffen Eiden
dd82c26f87
Add `pvsecret` a tool to create, add, list, and delete Ultravisor secrets. `pvsecret` uses the functionality from the pv-crate to provide an command line tool to manage the secrets. Add a new target group PV_TARGETS in rust/Makefile that additionally requires openssl and libcurl as pv with the feature "request" uses openssl and libcurl fearures. Acked-by: Jan Höppner <hoeppner@linux.ibm.com> Acked-by: Marc Hartmayer <mhartmay@linux.ibm.com> Signed-off-by: Steffen Eiden <seiden@linux.ibm.com> [hoeppner@linux.ibm.com: Adapt man pages and help output] Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
104 lines
3.0 KiB
Groff
104 lines
3.0 KiB
Groff
.\" Copyright 2023 IBM Corp.
|
|
.\" s390-tools is free software; you can redistribute it and/or modify
|
|
.\" it under the terms of the MIT license. See LICENSE for details.
|
|
.\"
|
|
|
|
.TH pvsecret 1 "2023-07-28" "s390-tools" "UV-Secret Manual"
|
|
.nh
|
|
.ad l
|
|
.SH NAME
|
|
\fBpvsecret\fP - Manage secrets for IBM Secure Execution guests
|
|
\fB
|
|
.SH SYNOPSIS
|
|
.nf
|
|
.fam C
|
|
pvsecret [OPTIONS] <COMMAND>
|
|
.fam C
|
|
.fi
|
|
.SH DESCRIPTION
|
|
Use \fBpvsecret\fR to manage secrets for IBM Secure Execution guests.
|
|
\fBpvsecret\fR can \fIcreate\fR add-secret requests on any architecture. On
|
|
s390x systems, use \fBpvsecret\fR to \fIadd\fR the secrets to the ultravisor
|
|
secret store, \fIlist\fR all secrets in the secret store, or \fIlock\fR the
|
|
secret store to prevent any modifications in the future.
|
|
|
|
The ultravisor secret store stores secrets for the IBM Secure Execution guest.
|
|
The secret store is cleared on guest reboot.
|
|
|
|
Create requests only on trusted systems that are not the IBM Secure Execution
|
|
guest where you want to inject the secrets. This approach prevents the secrets
|
|
from being in cleartext on the guest. For extra safety, do an attestation with
|
|
\fBpvattest\fR of your guest beforehand, and include the configuration UID in
|
|
the secret request using \fB--cuid\fR. Refer to \fBpvsecret-add\fR(1) for more
|
|
information. For all certificates, revocation lists, and host-key documents,
|
|
both the PEM and DER input formats are supported.
|
|
|
|
.SH OPTIONS
|
|
.PP
|
|
\-v, \-\-verbose
|
|
.RS 4
|
|
Provide more detailed output.
|
|
.RE
|
|
.RE
|
|
.PP
|
|
\-\-version
|
|
.RS 4
|
|
Print version information and exit.
|
|
.RE
|
|
.RE
|
|
|
|
.SH EXAMPLES
|
|
.PP
|
|
Create the add-secret request on a trusted system. The program generates three
|
|
files. \fFaddsecreq.bin\fP contains the add-secret request. \fFTEST.yaml\fP
|
|
contains the non-confidential information about the generated secret. It
|
|
contains the name and ID of the secret. \fFTEST\fP contains the plaintext secret
|
|
that is encrypted in the request. It can be used to generate add-secret requests
|
|
for a different guest with the same secret. Destroy the secret when it is not
|
|
used anymore.
|
|
.PP
|
|
.nf
|
|
.fam C
|
|
trusted:~$ pvsecret create -k hkd.crt --cert CA.crt --cert ibmsk.crt --hdr pvimage -o addsecreq.bin association EXAMPLE
|
|
Successfully generated the request
|
|
Successfully wrote association info to 'EXAMPLE.yaml'
|
|
Successfully wrote generated association secret to 'EXAMPLE'
|
|
.fam T
|
|
.fi
|
|
On the SE-guest, \fIadd\fP the secret from request to the secret store.
|
|
.PP
|
|
.nf
|
|
.fam C
|
|
seguest:~$ pvsecret add addsecreq.bin
|
|
Successfully added the secret
|
|
|
|
.fam T
|
|
.fi
|
|
On the SE-guest, \fIlist\fP the secrets currently stored.
|
|
.PP
|
|
.nf
|
|
.fam C
|
|
seguest:~$ pvsecret list
|
|
Total number of secrets: 1
|
|
|
|
0 Association:
|
|
94ee059335e587e501cc4bf90613e0814f00a7b08bc7c648fd865a2af6a22cc2
|
|
.fam T
|
|
.fi
|
|
|
|
On the SE-guest, \fIlock\fP the secret store.
|
|
.PP
|
|
.nf
|
|
.fam C
|
|
seguest:~$ pvsecret lock
|
|
Successfully locked secret store
|
|
seguest:~$ pvsecret add addsecreq.bin
|
|
error: Ultravisor: 'secret store locked' (0x0102)
|
|
|
|
|
|
.fam T
|
|
.fi
|
|
.SH "SEE ALSO"
|
|
.sp
|
|
\fBpvsecret-create\fR(1) \fBpvsecret-add\fR(1) \fBpvsecret-lock\fR(1) \fBpvsecret-list\fR(1) \fBpvsecret-version\fR(1)
|