mirror of
https://github.com/ibm-s390-linux/s390-tools.git
synced 2026-08-05 02:14:52 +00:00
3aa5c38714
Add 95ibm-sel-ebc dracut module for secure boot-time customization of SEL guests. Introduce the IBM SEL EBC dracut module (95ibm-sel-ebc) that enables Early Boot Customization for SEL guests during the initramfs phase. The module implements a critical security architecture to prevent injection attacks: all EBC resources (.asr and .pol files) are copied from /boot/sics (which resides in the qcow2 image on the host filesystem) to /run/ibm-sel-ebc (a tmpfs/RAM-backed directory). Since guest RAM is protected by the Ultravisor, this prevents malicious hosts from modifying EBC resources during boot. Systemd units and their purposes: - ibm-sel-ebc.target: Groups all EBC-related units - boot.mount: Mounts /dev/disk/by-label/boot to /boot - ibm-sel-ebc-ensure-sics.service: Fallback to create /boot/sics/ if boot partition mount fails (supports Kata VM scenarios) - ibm-sel-ebc-pvebc.service: Main unit that copies EBC resources to RAM, invokes pvebc tool to verify integrity and add ASRs to UV, retrieves LUKS passphrase from UV secret store - ibm-sel-ebc-override-crypttab.service: Replaces /etc/crypttab with prepared IBM SEL EBC crypttab, reloads systemd daemon, starts cryptsetup service - ibm-sel-ebc-paes-enforce.service: Verifies root filesystem uses PAES encryption to prevent root filesystem substitution attacks All units write logs to /boot/sics/log for debugging, accessible even if root filesystem fails to mount. Units are triggered by rd.ibm-sel-ebc kernel parameter and only execute in initramfs (ConditionPathExists=/etc/initrd-release). Assisted-by: IBM Bob:1.0.1 Reviewed-by: Holger Dengler <dengler@linux.ibm.com> Signed-off-by: Finn Callies <fcallies@linux.ibm.com> Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
77 lines
2.2 KiB
Bash
77 lines
2.2 KiB
Bash
#!/bin/bash
|
|
# SPDX-License-Identifier: MIT
|
|
#
|
|
# Copyright IBM Corp.
|
|
|
|
|
|
# Called by dracut
|
|
check() {
|
|
# always include
|
|
return 0
|
|
}
|
|
|
|
# Called by dracut
|
|
depends() {
|
|
# We need systemd in the initramfs
|
|
echo systemd
|
|
echo systemd-udevd
|
|
echo crypt
|
|
echo dm
|
|
return 0
|
|
}
|
|
|
|
# Called by dracut
|
|
installkernel() {
|
|
# kernel modules needed for opening an encrypted rfs
|
|
instmods -c uvdevice
|
|
instmods -c paes_s390
|
|
instmods -c pkey_uv
|
|
instmods -c pkey_pckmo
|
|
instmods -c pkey
|
|
}
|
|
|
|
# Called by dracut
|
|
install() {
|
|
# shellcheck disable=SC2154
|
|
# moddir, systemdsystemunitdir, and initdir are provided by dracut
|
|
# Copy the units into the initramfs' systemd unit dir
|
|
inst_simple "$moddir/sel-ebc.target" \
|
|
"$systemdsystemunitdir/sel-ebc.target"
|
|
inst_simple "$moddir/sel-ebc-pvebc.service" \
|
|
"$systemdsystemunitdir/sel-ebc-pvebc.service"
|
|
inst_simple "$moddir/sel-ebc-paes-enforce.service" \
|
|
"$systemdsystemunitdir/sel-ebc-paes-enforce.service"
|
|
inst_simple "$moddir/sel-ebc-override-crypttab.service" \
|
|
"$systemdsystemunitdir/sel-ebc-override-crypttab.service"
|
|
inst_simple "$moddir/boot.mount" \
|
|
"$systemdsystemunitdir/boot.mount"
|
|
|
|
# already exisitng unit we depend on for kernel modules
|
|
inst_simple /usr/lib/systemd/system/systemd-modules-load.service \
|
|
"$systemdsystemunitdir/systemd-modules-load.service"
|
|
|
|
# wrapper for sel-ebc.service
|
|
inst_simple "$moddir/pvebc-wrapper.sh" \
|
|
"/etc/sel-ebc/pvebc-wrapper.sh"
|
|
|
|
# override crypttab
|
|
inst_simple "$moddir/override-crypttab.sh" \
|
|
"/etc/sel-ebc/override-crypttab.sh"
|
|
|
|
# copy main application
|
|
inst_binary "/usr/bin/pvebc"
|
|
inst_binary "/usr/bin/pvsecret"
|
|
|
|
inst_simple "$moddir/sel-ebc.crypttab" "/etc/sel-ebc/crypttab"
|
|
|
|
# Create the enablement symlinks in the image using host systemctl:
|
|
# shellcheck disable=SC2154
|
|
inst_dir "$initdir/etc/systemd/system"
|
|
systemctl --root "$initdir" --no-reload --quiet enable sel-ebc.target
|
|
systemctl --root "$initdir" --no-reload --quiet enable sel-ebc-pvebc.service
|
|
systemctl --root "$initdir" --no-reload --quiet enable sel-ebc-override-crypttab.service
|
|
systemctl --root "$initdir" --no-reload --quiet enable sel-ebc-paes-enforce.service
|
|
systemctl --root "$initdir" --no-reload --quiet enable systemd-modules-load.service
|
|
systemctl --root "$initdir" --no-reload --quiet enable boot.mount
|
|
}
|