mirror of
https://github.com/ibm-s390-linux/s390-tools.git
synced 2026-08-05 02:14:52 +00:00
Steffen Eiden
1d6f7d0bec
man and README got out of sync with --help over time. Resync them. Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com> Signed-off-by: Steffen Eiden <seiden@linux.ibm.com> Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
134 lines
3.2 KiB
Groff
134 lines
3.2 KiB
Groff
.\" Copyright 2024, 2025 IBM Corp.
|
|
.\" s390-tools is free software; you can redistribute it and/or modify
|
|
.\" it under the terms of the MIT license. See LICENSE for details.
|
|
.\"
|
|
|
|
.TH "PVATTEST-CHECK" "1" "2026-05-19" "s390-tools" "Attestation Manual"
|
|
.nh
|
|
.ad l
|
|
.SH NAME
|
|
pvattest-check \- Check if the attestation result matches defined policies
|
|
.SH SYNOPSIS
|
|
.nf
|
|
.fam C
|
|
pvattest check [OPTIONS] [IN] [OUT]
|
|
.fam C
|
|
.fi
|
|
.SH DESCRIPTION
|
|
After the attestation verification, check whether the attestation result
|
|
complies with user\-defined policies.
|
|
.SH OPTIONS
|
|
.PP
|
|
<IN>
|
|
.RS 4
|
|
Specify the attestation response to check whether the policies are validated.
|
|
.RE
|
|
.RE
|
|
.PP
|
|
<OUT>
|
|
.RS 4
|
|
Specify the output file for the check result.
|
|
.RE
|
|
.RE
|
|
|
|
.PP
|
|
\-i, \-\-input <FILE>
|
|
.RS 4
|
|
Specify the attestation response to check whether the policies are validated.
|
|
.RE
|
|
.RE
|
|
.PP
|
|
\-o, \-\-output <FILE>
|
|
.RS 4
|
|
Specify the output file for the check result.
|
|
.RE
|
|
.RE
|
|
.PP
|
|
\-\-format <FORMAT>
|
|
.RS 4
|
|
Define the output format.
|
|
[default: 'yaml']
|
|
|
|
Possible values:
|
|
.RS 4
|
|
\- \fByaml\fP: Use yaml format.
|
|
|
|
.RE
|
|
.RE
|
|
.PP
|
|
\-k, \-\-host\-key\-document <FILE>
|
|
.RS 4
|
|
Use FILE to check for a host\-key document. Verifies that the attestation
|
|
response contains the host\-key hash of one of the specified host keys. The
|
|
check fails if none of the host\-keys match the hash in the response. This
|
|
parameter can be specified multiple times.
|
|
.RE
|
|
.RE
|
|
.PP
|
|
\-\-host\-key\-check <HOST_KEY_CHECKS>
|
|
.RS 4
|
|
Define the host\-key check policy By default, all host\-key hashes are checked,
|
|
and it is not considered a failure if a hash is missing from the attestation
|
|
response. Use this policy switch to trigger a failure if no corresponding hash
|
|
is found. Requires at least one host\-key document.
|
|
|
|
Possible values:
|
|
.RS 4
|
|
\- \fBatt-key-hash\fP: Check the host-key used for the attestation request.
|
|
|
|
\- \fBboot-key-hash\fP: Check the host-key used to the boot the image.
|
|
|
|
.RE
|
|
.RE
|
|
.PP
|
|
\-u, \-\-user\-data <FILE>
|
|
.RS 4
|
|
Check if the provided user data matches the data from the attestation response.
|
|
.RE
|
|
.RE
|
|
.PP
|
|
\-\-secret <FILE>
|
|
.RS 4
|
|
Use FILE to include as successful Add\-secret request. Checks if the Attestation
|
|
response contains the hash of all specified add secret requests\-tags. The hash
|
|
is sensible to the order in which the secrets where added. This means that if
|
|
the order of adding here different from the order the add\-secret requests where
|
|
sent to the UV this check will fail even though the same secrets are included in
|
|
the UV secret store. Can be specified multiple times.
|
|
.RE
|
|
.RE
|
|
.PP
|
|
\-\-secret\-store\-locked <BOOL>
|
|
.RS 4
|
|
Check whether the guests secret store is locked or not. Compares the hash of the
|
|
secret store state to the one calculated by this option and optionally specified
|
|
add\-secret\-requests in the correct order. If the attestation response does not
|
|
contain a secret store hash, this check fails.
|
|
|
|
Required if add\-secret\-requests are specified.
|
|
.RE
|
|
.RE
|
|
.PP
|
|
\-\-firmware
|
|
.RS 4
|
|
Check whether the firmware is supported by IBM. Requires internet access.
|
|
.RE
|
|
.RE
|
|
.PP
|
|
\-\-firmware\-verify\-url <URL>
|
|
.RS 4
|
|
Specify the endpoint to use for firmware version verification. Use an endpoint
|
|
you trust. Requires the \-\-firmware option.
|
|
.RE
|
|
.RE
|
|
.PP
|
|
\-h, \-\-help
|
|
.RS 4
|
|
Print help (see a summary with \fB\-h\fR).
|
|
.RE
|
|
.RE
|
|
|
|
.SH "SEE ALSO"
|
|
.sp
|
|
\fBpvattest\fR(1)
|