mirror of
https://github.com/ibm-s390-linux/s390-tools.git
synced 2026-08-05 02:14:52 +00:00
3aa5c38714
Add 95ibm-sel-ebc dracut module for secure boot-time customization of SEL guests. Introduce the IBM SEL EBC dracut module (95ibm-sel-ebc) that enables Early Boot Customization for SEL guests during the initramfs phase. The module implements a critical security architecture to prevent injection attacks: all EBC resources (.asr and .pol files) are copied from /boot/sics (which resides in the qcow2 image on the host filesystem) to /run/ibm-sel-ebc (a tmpfs/RAM-backed directory). Since guest RAM is protected by the Ultravisor, this prevents malicious hosts from modifying EBC resources during boot. Systemd units and their purposes: - ibm-sel-ebc.target: Groups all EBC-related units - boot.mount: Mounts /dev/disk/by-label/boot to /boot - ibm-sel-ebc-ensure-sics.service: Fallback to create /boot/sics/ if boot partition mount fails (supports Kata VM scenarios) - ibm-sel-ebc-pvebc.service: Main unit that copies EBC resources to RAM, invokes pvebc tool to verify integrity and add ASRs to UV, retrieves LUKS passphrase from UV secret store - ibm-sel-ebc-override-crypttab.service: Replaces /etc/crypttab with prepared IBM SEL EBC crypttab, reloads systemd daemon, starts cryptsetup service - ibm-sel-ebc-paes-enforce.service: Verifies root filesystem uses PAES encryption to prevent root filesystem substitution attacks All units write logs to /boot/sics/log for debugging, accessible even if root filesystem fails to mount. Units are triggered by rd.ibm-sel-ebc kernel parameter and only execute in initramfs (ConditionPathExists=/etc/initrd-release). Assisted-by: IBM Bob:1.0.1 Reviewed-by: Holger Dengler <dengler@linux.ibm.com> Signed-off-by: Finn Callies <fcallies@linux.ibm.com> Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>