mirror of
https://github.com/ibm-s390-linux/s390-tools.git
synced 2026-08-05 02:14:52 +00:00
ce9c518b97
The cpictl utility sends control-program identification data from protected virtualization guests to hosts by default. This behaviour leaks the below potentially sensitive information to untrusted hosts. - system_type - system_level - sysplex_name - system_name To prevent this behaviour, enhance the cpictl utility to stop setting CPI information on protected virtualization guests by default. If the user chooses to set the CPI information, it could be set by one of the below options - use the command line option --permit-cpi - set the environment variable CPI_PERMIT_ON_PVGUEST to 1 to control the CPI service behaviour during boot Signed-off-by: Hendrik Brueckner <brueckner@linux.ibm.com> Signed-off-by: Shalini Chellathurai Saroja <shalini@linux.ibm.com> Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com> Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com> Reviewed-by: Hendrik Brueckner <brueckner@linux.ibm.com> Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
48 lines
1.3 KiB
SYSTEMD
48 lines
1.3 KiB
SYSTEMD
# Service unit to apply control program identification (CPI) settings
|
|
#
|
|
# Copyright IBM Corp. 2017
|
|
#
|
|
# s390-tools is free software; you can redistribute it and/or modify
|
|
# it under the terms of the MIT license. See LICENSE for details.
|
|
#
|
|
|
|
[Unit]
|
|
After=sysinit.target
|
|
Before=shutdown.target
|
|
ConditionPathIsReadWrite=/sys/firmware/cpi
|
|
Conflicts=shutdown.target
|
|
DefaultDependencies=no
|
|
Description=Apply Control Program Identification (CPI)
|
|
Requires=sysinit.target
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
RemainAfterExit=yes
|
|
#
|
|
# Specify a file with the environment variables using the EnvironmentFile=
|
|
# service property.
|
|
#
|
|
EnvironmentFile=@sysconf_path@/sysconfig/cpi
|
|
#
|
|
# Alternatively, you can specify the environment variables directly,
|
|
# using the Environment= service properties, which can be overridden by
|
|
# "systemctl edit --full cpi".
|
|
# In this case, the EnvironmentFile= needs to be commented out, otherwise
|
|
# it would override the directly specified variables.
|
|
#
|
|
# The sysplex name, system name, and system type consist of up to eight
|
|
# characters of the following set: A-Z, 0-9, $, @, #, and blank.
|
|
#
|
|
# Environment=CPI_SYSTEM_NAME=
|
|
# Environment=CPI_SYSPLEX_NAME=
|
|
# Environment=CPI_SYSTEM_LEVEL=
|
|
# Environment=CPI_SYSTEM_TYPE=LINUX
|
|
# Environment=CPI_PERMIT_ON_PVGUEST=
|
|
|
|
#
|
|
# Sending data to the HMC/SE
|
|
ExecStart=@toolslib_path@/cpictl -e
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|