mirror of
https://github.com/ibm-s390-linux/s390-tools.git
synced 2026-08-05 02:14:52 +00:00
c04a0919f6
Add pvebc tool for parsing and verifying EBC Add-Secret-Request structures Introduce pvebc, a CLI tool that parses and verifies the integrity of Add-Secret-Request (ASR) structures used in Early Boot Customization for SEL guests. The tool processes an integrity-protected ASR structure consisting of: - toc.asr: Meta secret that links to toc.pol via relative filepath and SHA512 hash, integrity-protected by its AES GCM authentication tag - toc.pol: Policy file containing AES GCM authentication tags (last 16 bytes) of all user-provided ASRs - User ASRs: Individual Add-Secret-Requests containing encrypted secrets This structure guarantees: - Prevents ASR removal: toc.pol lists all expected ASR authentication tags - Prevents ASR insertion: Unlisted ASRs are rejected - Prevents ASR modification: AES GCM authentication tags provide cryptographic integrity - Prevents toc.pol tampering: toc.asr's integrity protection secures the link The tool verifies completeness by checking that all ASRs listed in toc.pol are present and their AES GCM authentication tags match. This prevents attackers from removing, inserting, or modifying ASRs during transport over unsecured channels. After verification, pvebc adds all ASRs to the Ultravisor (UV), which decrypts them using the guest's secret key and makes them available to the guest during early boot. Assisted-by: IBM Bob:1.0.1 Acked-by: Holger Dengler <dengler@linux.ibm.com> Reviewed-by: Steffen Eiden <seiden@linux.ibm.com> Signed-off-by: Finn Callies <fcallies@linux.ibm.com> Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
40 lines
1.4 KiB
Rust
40 lines
1.4 KiB
Rust
// SPDX-License-Identifier: MIT
|
|
//
|
|
// Copyright IBM Corp.
|
|
|
|
use std::{path::PathBuf, sync::OnceLock};
|
|
|
|
use clap::{ArgAction, Parser, ValueHint};
|
|
|
|
static VERSION: OnceLock<String> = OnceLock::new();
|
|
|
|
/// The pvebc command processes an AddSecretRequest file (toc.asr) that defines the root of EBC
|
|
/// resources. It validates references to the associated toc.pol policy and manages their addition,
|
|
/// with options for verification and dry-run execution.
|
|
#[derive(Parser)]
|
|
#[command(long_version=ver(), disable_version_flag(true))]
|
|
pub struct Cli {
|
|
/// Print version information and exit.
|
|
#[arg(long, action=ArgAction::Version)]
|
|
version: (),
|
|
|
|
/// Specifies the toc.asr which is the root of the EBC resources
|
|
///
|
|
/// Specify the add-secret request file toc.asr that serves as the root of the EBC resources.
|
|
/// Its user data must contain a reference to toc.pol as generated by pvsecret with the --policy
|
|
/// option.
|
|
#[arg(short, long, value_name = "FILE", value_hint = ValueHint::FilePath)]
|
|
pub toc: PathBuf,
|
|
|
|
/// Prevents adding of the AddSecretRequest
|
|
///
|
|
/// Do not add the AddSecretRequest. Use this option to validate a generated policy. It can be
|
|
/// run on a non-SEL guest to verify ASR-to-policy links and the associated policy toc.pol.
|
|
#[arg(long)]
|
|
pub dry_run: bool,
|
|
}
|
|
|
|
fn ver() -> &'static str {
|
|
VERSION.get_or_init(|| utils::tools_version_fmt!(2026))
|
|
}
|