mirror of
https://github.com/ibm-s390-linux/s390-tools.git
synced 2026-08-05 02:14:52 +00:00
Steffen Eiden
4df0781989
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com> Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
123 lines
3.0 KiB
Groff
123 lines
3.0 KiB
Groff
.\" Copyright 2024 IBM Corp.
|
|
.\" s390-tools is free software; you can redistribute it and/or modify
|
|
.\" it under the terms of the MIT license. See LICENSE for details.
|
|
.\"
|
|
|
|
.TH pvattest-check 1 "2024-12-05" "s390-tools" "Attestation Manual"
|
|
.nh
|
|
.ad l
|
|
.SH NAME
|
|
\fBpvattest check\fP - Check if the attestation result matches defined policies
|
|
\fB
|
|
.SH SYNOPSIS
|
|
.nf
|
|
.fam C
|
|
pvattest check [OPTIONS] <IN> <OUT>
|
|
.fam C
|
|
.fi
|
|
.SH DESCRIPTION
|
|
After the attestation verification, check whether the attestation result
|
|
complies with user-defined policies.
|
|
.SH OPTIONS
|
|
.PP
|
|
<IN>
|
|
.RS 4
|
|
Specify the attestation response to check whether the policies are validated.
|
|
.RE
|
|
.RE
|
|
.PP
|
|
<OUT>
|
|
.RS 4
|
|
Specify the output file for the check result.
|
|
.RE
|
|
.RE
|
|
|
|
.PP
|
|
\-\-format <FORMAT>
|
|
.RS 4
|
|
Define the output format.
|
|
[default: 'yaml']
|
|
|
|
Possible values:
|
|
.RS 4
|
|
- \fByaml\fP: Use yaml format.
|
|
|
|
.RE
|
|
.RE
|
|
.PP
|
|
\-k, \-\-host-key-document <FILE>
|
|
.RS 4
|
|
Use FILE to check for a host-key document. Verifies that the attestation
|
|
response contains the host-key hash of one of the specified host keys. The check
|
|
fails if none of the host-keys match the hash in the response. This parameter
|
|
can be specified multiple times.
|
|
.RE
|
|
.RE
|
|
.PP
|
|
\-\-host-key-check <HOST_KEY_CHECKS>
|
|
.RS 4
|
|
Define the host-key check policy By default, all host-key hashes are checked,
|
|
and it is not considered a failure if a hash is missing from the attestation
|
|
response. Use this policy switch to trigger a failure if no corresponding hash
|
|
is found. Requires at least one host-key document.
|
|
|
|
Possible values:
|
|
.RS 4
|
|
- \fBatt-key-hash\fP: Check the host-key used for the attestation request.
|
|
|
|
- \fBboot-key-hash\fP: Check the host-key used to the boot the image.
|
|
|
|
.RE
|
|
.RE
|
|
.PP
|
|
\-u, \-\-user-data <FILE>
|
|
.RS 4
|
|
Check if the provided user data matches the data from the attestation response.
|
|
.RE
|
|
.RE
|
|
.PP
|
|
\-\-secret <FILE>
|
|
.RS 4
|
|
Use FILE to include as successful Add-secret request. Checks if the Attestation
|
|
response contains the hash of all specified add secret requests-tags. The hash
|
|
is sensible to the order in which the secrets where added. This means that if
|
|
the order of adding here different from the order the add-secret requests where
|
|
sent to the UV this check will fail even though the same secrets are included in
|
|
the UV secret store. Can be specified multiple times.
|
|
.RE
|
|
.RE
|
|
.PP
|
|
\-\-secret-store-locked <BOOL>
|
|
.RS 4
|
|
Check whether the guests secret store is locked or not. Compares the hash of the
|
|
secret store state to the one calculated by this option and optionally specified
|
|
add-secret-requests in the correct order. If the attestation response does not
|
|
contain a secret store hash, this check fails.
|
|
|
|
Required if add-secret-requests are specified.
|
|
.RE
|
|
.RE
|
|
.PP
|
|
\-\-firmware
|
|
.RS 4
|
|
Check whether the firmware is supported by IBM. Requires internet access.
|
|
.RE
|
|
.RE
|
|
.PP
|
|
\-\-firmware-verify-url <URL>
|
|
.RS 4
|
|
Specify the endpoint to use for firmware version verification. Use an endpoint
|
|
you trust. Requires the \fB--firmware\fR option.
|
|
.RE
|
|
.RE
|
|
.PP
|
|
\-h, \-\-help
|
|
.RS 4
|
|
Print help (see a summary with '-h').
|
|
.RE
|
|
.RE
|
|
|
|
.SH "SEE ALSO"
|
|
.sp
|
|
\fBpvattest\fR(1)
|