mirror of
https://github.com/ibm-s390-linux/s390-tools.git
synced 2026-08-05 02:14:52 +00:00
ce9c518b97
The cpictl utility sends control-program identification data from protected virtualization guests to hosts by default. This behaviour leaks the below potentially sensitive information to untrusted hosts. - system_type - system_level - sysplex_name - system_name To prevent this behaviour, enhance the cpictl utility to stop setting CPI information on protected virtualization guests by default. If the user chooses to set the CPI information, it could be set by one of the below options - use the command line option --permit-cpi - set the environment variable CPI_PERMIT_ON_PVGUEST to 1 to control the CPI service behaviour during boot Signed-off-by: Hendrik Brueckner <brueckner@linux.ibm.com> Signed-off-by: Shalini Chellathurai Saroja <shalini@linux.ibm.com> Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com> Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com> Reviewed-by: Hendrik Brueckner <brueckner@linux.ibm.com> Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
35 lines
702 B
Plaintext
35 lines
702 B
Plaintext
#
|
|
# Apply control program identification (CPI) settings
|
|
#
|
|
# The system and sysplex names consist of up to eight characters of
|
|
# the following set: A-Z, 0-9, $, @, #, and blank.
|
|
|
|
#
|
|
# CPI system type
|
|
#
|
|
CPI_SYSTEM_TYPE="LINUX"
|
|
|
|
#
|
|
# CPI system name
|
|
#
|
|
CPI_SYSTEM_NAME=""
|
|
|
|
#
|
|
# CPI sysplex name
|
|
#
|
|
CPI_SYSPLEX_NAME=""
|
|
|
|
#
|
|
# CPI permit on protected virtualization guests
|
|
#
|
|
# Important: Set CPI_PERMIT_ON_PVGUEST=1 only if you trust the host system.
|
|
# Enabling these options allows the host to receive potentially sensitive
|
|
# Control-Program Identification (CPI) data from the protected virtualization
|
|
# guest, including:
|
|
# - system_type
|
|
# - system_level
|
|
# - sysplex_name
|
|
# - system_name
|
|
#
|
|
CPI_PERMIT_ON_PVGUEST=
|