mirror of
https://github.com/ibm-s390-linux/s390-tools.git
synced 2026-08-05 02:14:52 +00:00
Steffen Eiden
a8a3e7d49c
Acked-by: Marc Hartmayer <marc@linux.ibm.com> Reviewed-by: Christoph Schlameuss <schlameuss@linux.ibm.com> Signed-off-by: Steffen Eiden <seiden@linux.ibm.com> Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
75 lines
1.9 KiB
Groff
75 lines
1.9 KiB
Groff
.\" Copyright 2024 IBM Corp.
|
|
.\" s390-tools is free software; you can redistribute it and/or modify
|
|
.\" it under the terms of the MIT license. See LICENSE for details.
|
|
.\"
|
|
|
|
.TH "PVSECRET-CREATE-RETRIEVABLE" "1" "2024-12-19" "s390-tools" "UV-Secret Manual"
|
|
.nh
|
|
.ad l
|
|
.SH NAME
|
|
pvsecret-create-retrievable \- Create a retrievable secret
|
|
.SH SYNOPSIS
|
|
.nf
|
|
.fam C
|
|
pvsecret create retrievable [OPTIONS] --secret <SECRET-FILE> --type <TYPE> <NAME>
|
|
pvsecret create retr [OPTIONS] --secret <SECRET-FILE> --type <TYPE> <NAME>
|
|
.fam C
|
|
.fi
|
|
.SH DESCRIPTION
|
|
A retrievable secret is stored in the per\-guest storage of the Ultravisor. A
|
|
SE\-guest can retrieve the secret at runtime and use it. All retrievable
|
|
secrets, but the plaintext secret, are retrieved as wrapped/protected key
|
|
objects and only usable inside the current, running SE\-guest instance.
|
|
.SH OPTIONS
|
|
.PP
|
|
<NAME>
|
|
.RS 4
|
|
String that identifies the new secret. The actual secret is set with
|
|
\fB\-\-secret\fR. The name is saved in `NAME.yaml` with white\-spaces mapped to
|
|
`_`.
|
|
.RE
|
|
.RE
|
|
|
|
.PP
|
|
\-\-stdout
|
|
.RS 4
|
|
Print the hashed name to stdout. The hashed name is not written to `NAME.yaml`
|
|
.RE
|
|
.RE
|
|
.PP
|
|
\-\-secret <SECRET-FILE>
|
|
.RS 4
|
|
Use SECRET\-FILE as retrievable secret.
|
|
.RE
|
|
.RE
|
|
.PP
|
|
\-\-type <TYPE>
|
|
.RS 4
|
|
Specify the secret type. Limitations to the input data apply depending on the
|
|
secret type.
|
|
|
|
Possible values:
|
|
.RS 4
|
|
\- \fBplain\fP: A plaintext secret. Can be any file up to 8190 bytes long.
|
|
|
|
\- \fBaes\fP: An AES key. Must be a plain byte file 128, 192, or 256 bit long.
|
|
|
|
\- \fBaes-xts\fP: An AES-XTS key. Must be a plain byte file 512, or 1024 bit long.
|
|
|
|
\- \fBhmac-sha\fP: A HMAC-SHA key. Must be a plain byte file 512, or 1024 bit long.
|
|
|
|
\- \fBec\fP: An elliptic curve private key. Must be a PEM or DER file.
|
|
|
|
.RE
|
|
.RE
|
|
.PP
|
|
\-h, \-\-help
|
|
.RS 4
|
|
Print help (see a summary with \fB\-h\fR).
|
|
.RE
|
|
.RE
|
|
|
|
.SH "SEE ALSO"
|
|
.sp
|
|
\fBpvsecret\fR(1) \fBpvsecret-create\fR(1)
|