From nobody Fri Apr 26 03:07:47 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of redhat.com designates 170.10.129.124 as permitted sender) client-ip=170.10.129.124; envelope-from=libvir-list-bounces@redhat.com; helo=us-smtp-delivery-124.mimecast.com; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of redhat.com designates 170.10.129.124 as permitted sender) smtp.mailfrom=libvir-list-bounces@redhat.com; dmarc=pass(p=none dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1667831983; cv=none; d=zohomail.com; s=zohoarc; b=hfbZy/peMzWkH6ULlahaco6kkIV5W6bQbM4UdZwdvGvj0iyOMlopIjQM1GjSmTDgxG+z3hFSL6qFIetnIGOqS1rTuVmC3O321fIJpbPXhD7ipxwpyeRYBP5P2WJTmMscFoc1jdC8AL+NJKRLVlaNHwjTWTjozX1lvgFQg24WvCg= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1667831983; h=Content-Type:Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:To; bh=eqxhYyeojQe2Ib53kjbVyPX79LdO/gqtoV91n+Zc3z4=; b=i6P5atRT4wDkN11iqexFIqxfZJiRXvnA+SCyE3vSqP/XXbRCU2w1v/TQCj0NBa3QiEzt7nyA9cfKdQC4QIOmO+P42soQdiZzXhbG2YnDPmVjCTWkk4Sj0TYPDKpB/j+8GKeX0P1x5jnaNkbHfnB1pSYMhpGGGOOYTW3xcmEAiyQ= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of redhat.com designates 170.10.129.124 as permitted sender) smtp.mailfrom=libvir-list-bounces@redhat.com; dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by mx.zohomail.com with SMTPS id 1667831983389269.712745264858; Mon, 7 Nov 2022 06:39:43 -0800 (PST) Received: from mimecast-mx02.redhat.com (mx3-rdu2.redhat.com [66.187.233.73]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-413-ugZYicufOp2fFLiJoEcMLA-1; Mon, 07 Nov 2022 09:39:35 -0500 Received: from smtp.corp.redhat.com (int-mx06.intmail.prod.int.rdu2.redhat.com [10.11.54.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 1D1162932494; Mon, 7 Nov 2022 14:39:32 +0000 (UTC) Received: from mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (unknown [10.30.29.100]) by smtp.corp.redhat.com (Postfix) with ESMTP id 733622166B31; Mon, 7 Nov 2022 14:39:31 +0000 (UTC) Received: from mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (localhost [IPv6:::1]) by mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (Postfix) with ESMTP id 04C6219465B3; Mon, 7 Nov 2022 14:39:24 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx09.intmail.prod.int.rdu2.redhat.com [10.11.54.9]) by mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (Postfix) with ESMTP id 1CBD019465B1 for ; Mon, 7 Nov 2022 14:39:22 +0000 (UTC) Received: by smtp.corp.redhat.com (Postfix) id 02CDD4B3FCD; Mon, 7 Nov 2022 14:39:22 +0000 (UTC) Received: from localhost.localdomain.com (unknown [10.33.36.58]) by smtp.corp.redhat.com (Postfix) with ESMTP id DECD74B3FC6; Mon, 7 Nov 2022 14:39:19 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1667831982; h=from:from:sender:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:list-id:list-help: list-unsubscribe:list-subscribe:list-post; bh=eqxhYyeojQe2Ib53kjbVyPX79LdO/gqtoV91n+Zc3z4=; b=DwKQJmtJatSWWt9Hci/pQU0b7h/BzfcNu0cMiK85LyBuMMdaiSnZiqRG4q4bUeJvHJ9hk5 uz4w0yT83R6LQwppqz+2ShIITOLmyDek5lF2gJ33hJOKOjSAko4ceLj1QHKFF7fpXmKrIc HQe6LlpwHQSuywHXvvjXzR50EXKH0cY= X-MC-Unique: ugZYicufOp2fFLiJoEcMLA-1 X-Original-To: libvir-list@listman.corp.redhat.com From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= To: libvir-list@redhat.com Subject: [libvirt PATCH v4 1/4] build-aux: only forbid gethostname in C files Date: Mon, 7 Nov 2022 14:39:07 +0000 Message-Id: <20221107143910.972928-2-berrange@redhat.com> In-Reply-To: <20221107143910.972928-1-berrange@redhat.com> References: <20221107143910.972928-1-berrange@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.1 on 10.11.54.9 X-BeenThere: libvir-list@redhat.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Development discussions about the libvirt library & tools List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: =?UTF-8?q?J=C3=A1n=20Tomko?= Errors-To: libvir-list-bounces@redhat.com Sender: "libvir-list" X-Scanned-By: MIMEDefang 3.1 on 10.11.54.6 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1667831983762100001 This function is fine to use in other languages Reviewed-by: J=C3=A1n Tomko Signed-off-by: Daniel P. Berrang=C3=A9 --- build-aux/syntax-check.mk | 1 + 1 file changed, 1 insertion(+) diff --git a/build-aux/syntax-check.mk b/build-aux/syntax-check.mk index 68cd9dff5f..e1d80bd536 100644 --- a/build-aux/syntax-check.mk +++ b/build-aux/syntax-check.mk @@ -203,6 +203,7 @@ sc_prohibit_readlink: =20 sc_prohibit_gethostname: @prohibit=3D'gethostname *\(' \ + in_vc_files=3D'\.[ch]$$' \ halt=3D'use virGetHostname, not gethostname' \ $(_sc_search_regexp) =20 --=20 2.37.3 From nobody Fri Apr 26 03:07:47 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of redhat.com designates 170.10.133.124 as permitted sender) client-ip=170.10.133.124; envelope-from=libvir-list-bounces@redhat.com; helo=us-smtp-delivery-124.mimecast.com; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of redhat.com designates 170.10.133.124 as permitted sender) smtp.mailfrom=libvir-list-bounces@redhat.com; dmarc=pass(p=none dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1667832044; cv=none; d=zohomail.com; s=zohoarc; b=a0bs2OyQUib2vapk9t4N4br8PIK7W4uGelHcSsGKcH37EIkU7hJNdz7g3HXZ1c3TGTK6GKT770oTYIQ3jTHuAMEKkF/KWyTVe4ZsIbkbaduMsD7aW3opgdF4+igjborGhTJpst4TUVcevlgKsXujgsJg9mwBqsPMLvwx1BkWh9U= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1667832044; h=Content-Type:Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:To; bh=tSl0Qo43H320Kc2stgLLsKwjEyUKHgW0OhdTfS3RJ1k=; b=D5tSQqfMx21lnmCmKS0YWDSIaVHtayCy5dKNWRPFTwwYzmK9xFjTOzTSeqVXvupGZPhQfAWeL4tX0ZaWrql+bIQzGqElud+xxaI1685tccrSht54gR29DTydQJd6sjOHPvYmAyykabSB9ZvDkXqvCMd2HU7+sMH14mELrrH6lr0= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of redhat.com designates 170.10.133.124 as permitted sender) smtp.mailfrom=libvir-list-bounces@redhat.com; dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) by mx.zohomail.com with SMTPS id 1667832044891287.33830250285325; Mon, 7 Nov 2022 06:40:44 -0800 (PST) Received: from mimecast-mx02.redhat.com (mimecast-mx02.redhat.com [66.187.233.88]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-659-jR1clSzVO8eU2MHCcZXXHA-1; Mon, 07 Nov 2022 09:39:45 -0500 Received: from smtp.corp.redhat.com (int-mx04.intmail.prod.int.rdu2.redhat.com [10.11.54.4]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 09033858282; Mon, 7 Nov 2022 14:39:37 +0000 (UTC) Received: from mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (unknown [10.30.29.100]) by smtp.corp.redhat.com (Postfix) with ESMTP id E881A2028DC1; Mon, 7 Nov 2022 14:39:36 +0000 (UTC) Received: from mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (localhost [IPv6:::1]) by mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (Postfix) with ESMTP id 434351946A45; Mon, 7 Nov 2022 14:39:24 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx09.intmail.prod.int.rdu2.redhat.com [10.11.54.9]) by mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (Postfix) with ESMTP id 80DB319465B2 for ; Mon, 7 Nov 2022 14:39:23 +0000 (UTC) Received: by smtp.corp.redhat.com (Postfix) id 66B5B4B3FC8; Mon, 7 Nov 2022 14:39:23 +0000 (UTC) Received: from localhost.localdomain.com (unknown [10.33.36.58]) by smtp.corp.redhat.com (Postfix) with ESMTP id 5EED34B3FC6; Mon, 7 Nov 2022 14:39:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1667832043; h=from:from:sender:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:list-id:list-help: list-unsubscribe:list-subscribe:list-post; bh=tSl0Qo43H320Kc2stgLLsKwjEyUKHgW0OhdTfS3RJ1k=; b=R/UCBqirjys0oXNHdW+mEq1EiuZzVX4pvpPkzx8GSO0FQowziDcYJ1DBVIgV+gAegU2tLH B0TIdKxsIru1851jq+kgRyIUYIU+VnNmImEgzGK9ayO5QZfZJyX/qkuYFZT0XnFzwAGkJ5 OHjhNHHbnEGrm1+nPAVMqTTj3AOityw= X-MC-Unique: jR1clSzVO8eU2MHCcZXXHA-1 X-Original-To: libvir-list@listman.corp.redhat.com From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= To: libvir-list@redhat.com Subject: [libvirt PATCH v4 2/4] tools: support validating SEV firmware boot measurements Date: Mon, 7 Nov 2022 14:39:08 +0000 Message-Id: <20221107143910.972928-3-berrange@redhat.com> In-Reply-To: <20221107143910.972928-1-berrange@redhat.com> References: <20221107143910.972928-1-berrange@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.1 on 10.11.54.9 X-BeenThere: libvir-list@redhat.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Development discussions about the libvirt library & tools List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: =?UTF-8?q?J=C3=A1n=20Tomko?= Errors-To: libvir-list-bounces@redhat.com Sender: "libvir-list" X-Scanned-By: MIMEDefang 3.1 on 10.11.54.4 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1667832046086100001 The virt-qemu-sev-validate program will compare a reported SEV/SEV-ES domain launch measurement, to a computed launch measurement. This determines whether the domain has been tampered with during launch. This initial implementation requires all inputs to be provided explicitly, and as such can run completely offline, without any connection to libvirt. The tool is placed in the libvirt-client-qemu sub-RPM since it is specific to the QEMU driver. Reviewed-by: J=C3=A1n Tomko Signed-off-by: Daniel P. Berrang=C3=A9 --- docs/manpages/meson.build | 1 + docs/manpages/virt-qemu-sev-validate.rst | 207 ++++++++++++++++++ libvirt.spec.in | 2 + tools/meson.build | 5 + tools/virt-qemu-sev-validate | 263 +++++++++++++++++++++++ 5 files changed, 478 insertions(+) create mode 100644 docs/manpages/virt-qemu-sev-validate.rst create mode 100755 tools/virt-qemu-sev-validate diff --git a/docs/manpages/meson.build b/docs/manpages/meson.build index b5556996a4..84b2e247e9 100644 --- a/docs/manpages/meson.build +++ b/docs/manpages/meson.build @@ -20,6 +20,7 @@ docs_man_files =3D [ { 'name': 'virt-qemu-run', 'section': '1', 'install': conf.has('WITH_QEM= U') }, { 'name': 'virt-qemu-qmp-proxy', 'section': '1', 'install': conf.has('WI= TH_QEMU') }, { 'name': 'virt-xml-validate', 'section': '1', 'install': true }, + { 'name': 'virt-qemu-sev-validate', 'section': '1', 'install': conf.has(= 'WITH_QEMU') }, =20 { 'name': 'libvirt-guests', 'section': '8', 'install': conf.has('WITH_LI= BVIRTD') }, { 'name': 'libvirtd', 'section': '8', 'install': conf.has('WITH_LIBVIRTD= ') }, diff --git a/docs/manpages/virt-qemu-sev-validate.rst b/docs/manpages/virt-= qemu-sev-validate.rst new file mode 100644 index 0000000000..0f6c64ba90 --- /dev/null +++ b/docs/manpages/virt-qemu-sev-validate.rst @@ -0,0 +1,207 @@ +=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D +virt-qemu-sev-validate +=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D + +-------------------------------------------- +validate a domain AMD SEV launch measurement +-------------------------------------------- + +:Manual section: 1 +:Manual group: Virtualization Support + +.. contents:: + +SYNOPSIS +=3D=3D=3D=3D=3D=3D=3D=3D + + +``virt-qemu-sev-validate`` [*OPTIONS*] + + +DESCRIPTION +=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D + +This program validates the reported measurement for a domain launched with= AMD +SEV. If the program exits with a status of zero, the guest owner can be +confident that their guest OS is running under the protection offered by t= he +SEV / SEV-ES platform. + +Note that the level of protection varies depending on the AMD SEV platform +generation and describing the differences is outside the scope of this +document. + +For the results of this program to be considered trustworthy, it is requir= ed to +be run on a machine that is already trusted by the guest owner. This could= be a +machine that the guest owner has direct physical control over, or it could= be +another virtual machine protected by AMD SEV that has already had its laun= ch +measurement validated. Running this program on the virtualization host wil= l not +produce an answer that can be trusted. + +OPTIONS +=3D=3D=3D=3D=3D=3D=3D + +Common options +-------------- + +``-h``, ``--help`` + +Display command line help usage then exit. + +``-d``, ``--debug`` + +Show debug information while running + +``-q``, ``--quiet`` + +Don't print information about the attestation result. + +Guest state options +------------------- + +These options provide information about the state of the guest that needs = its +boot attested. + +``--measurement BASE64-STRING`` + +The launch measurement reported by the hypervisor of the domain to be vali= dated. +The measurement must be 48 bytes of binary data encoded as a base64 string. + +``--api-major VERSION`` + +The SEV API major version of the hypervisor the domain is running on. + +``--api-minor VERSION`` + +The SEV API major version of the hypervisor the domain is running on. + +``--build-id ID`` + +The SEV build ID of the hypervisor the domain is running on. + +``--policy POLiCY`` + +The policy bitmask associated with the session launch data of the domain t= o be +validated. + +Guest config options +-------------------- + +These options provide items needed to calculate the expected domain launch +measurement. This will then be compared to the reported launch measurement. + +``-f PATH``, ``--firmware=3DPATH`` + +Path to the firmware loader binary. This is the EDK2 build that knows how = to +initialize AMD SEV. For the validation to be trustworthy it important that= the +firmware build used has no support for loading non-volatile variables from +NVRAM, even if NVRAM is expose to the guest. + +``--tik PATH`` + +TIK file for domain. This file must be exactly 16 bytes in size and contai= ns the +unique transport integrity key associated with the domain session launch d= ata. +This is mutually exclusive with the ``--tk`` argument. + +``--tek PATH`` + +TEK file for domain. This file must be exactly 16 bytes in size and contai= ns the +unique transport encryption key associated with the domain session launch = data. +This is mutually exclusive with the ``--tk`` argument. + +``--tk PATH`` + +TEK/TIK combined file for the domain. This file must be exactly 32 bytes in +size, with the first 16 bytes containing the TEK and the last 16 bytes +containing the TIK. This is mutually exclusive with the ``--tik`` and ``-= -tek`` +arguments. + +EXAMPLES +=3D=3D=3D=3D=3D=3D=3D=3D + +Fully offline execution +----------------------- + +This scenario allows a measurement to be securely validated in a completely +offline state without any connection to the hypervisor host. All required +data items must be provided as command line parameters. This usage model is +considered secure, because all input data is provided by the user. + +Validate the measurement of a SEV guest booting from disk: + +:: + + # virt-qemu-sev-validate \ + --firmware OVMF.sev.fd \ + --tk this-guest-tk.bin \ + --measurement Zs2pf19ubFSafpZ2WKkwquXvACx9Wt/BV+eJwQ/taO8jhyIj/F8sw= FrybR1fZ2ID \ + --api-major 0 \ + --api-minor 24 \ + --build-id 13 \ + --policy 3 + +EXIT STATUS +=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D + +Upon successful attestation of the launch measurement, an exit status of 0= will +be set. + +Upon failure to attest the launch measurement one of the following codes w= ill +be set: + +* **1** - *Guest measurement did not validate* + + Assuming the inputs to this program are correct, the virtual machine lau= nch + has been compromised and it should not be trusted henceforth. + +* **2** - *Usage scenario cannot be supported* + + The way in which this program has been invoked prevent it from being abl= e to + validate the launch measurement. + +* **3** - *unexpected error occurred in the code* + + A logic flaw in this program means it is unable to complete the validati= on of + the measurement. This is a bug which should be reported to the maintaine= rs. + +AUTHOR +=3D=3D=3D=3D=3D=3D + +Daniel P. Berrang=C3=A9 + + +BUGS +=3D=3D=3D=3D + +Please report all bugs you discover. This should be done via either: + +#. the mailing list + + `https://libvirt.org/contact.html `_ + +#. the bug tracker + + `https://libvirt.org/bugs.html `_ + +Alternatively, you may report bugs to your software distributor / vendor. + + +COPYRIGHT +=3D=3D=3D=3D=3D=3D=3D=3D=3D + +Copyright (C) 2022 by Red Hat, Inc. + + +LICENSE +=3D=3D=3D=3D=3D=3D=3D + +``virt-qemu-sev-validate`` is distributed under the terms of the GNU LGPL = v2.1+. +This is free software; see the source for copying conditions. There +is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR +PURPOSE + + +SEE ALSO +=3D=3D=3D=3D=3D=3D=3D=3D + +virsh(1), `SEV launch security usage `_, +`https://www.libvirt.org/ `_ diff --git a/libvirt.spec.in b/libvirt.spec.in index 5ea9ef2912..a24e4d1159 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -2179,7 +2179,9 @@ exit 0 %if %{with_qemu} %files client-qemu %{_mandir}/man1/virt-qemu-qmp-proxy.1* +%{_mandir}/man1/virt-qemu-sev-validate.1* %{_bindir}/virt-qemu-qmp-proxy +%{_bindir}/virt-qemu-sev-validate %endif =20 %files libs -f %{name}.lang diff --git a/tools/meson.build b/tools/meson.build index 20509906af..c41c619af4 100644 --- a/tools/meson.build +++ b/tools/meson.build @@ -299,6 +299,11 @@ if conf.has('WITH_SANLOCK') ) endif =20 +if conf.has('WITH_QEMU') + install_data('virt-qemu-sev-validate', + install_dir: bindir) +endif + if conf.has('WITH_LIBVIRTD') configure_file( input: 'libvirt-guests.sh.in', diff --git a/tools/virt-qemu-sev-validate b/tools/virt-qemu-sev-validate new file mode 100755 index 0000000000..7ff54e7623 --- /dev/null +++ b/tools/virt-qemu-sev-validate @@ -0,0 +1,263 @@ +#!/usr/bin/python3 +# +# SPDX-License-Identifier: LGPL-2.1-or-later +# +# Validates a guest AMD SEV launch measurement +# +# A general principle in writing this tool is that it must calculate the +# expected measurement based entirely on information it receives on the CLI +# from the guest owner. +# +# It cannot generally trust information obtained from the guest XML or fro= m the +# virtualization host OS. The main exceptions are: +# +# - The guest measurement +# +# This is a result of cryptographic operation using a shared secret kno= wn +# only to the guest owner and SEV platform, not the host OS. +# +# - The guest policy +# +# This is encoded in the launch session blob that is encrypted with a s= hared +# secret known only to the guest owner and SEV platform, not the host O= S. It +# is impossible for the host OS to maliciously launch a guest with diff= erent +# policy and the user provided launch session blob. +# +# CAVEAT: the user must ALWAYS create a launch blob with freshly genera= ted +# TIK/TEK for every new VM. Re-use of the same TIK/TEK for multiple VMs +# is insecure. +# +# - The SEV API version / build ID +# +# This does not have an impact on the security of the measurement, unle= ss +# the guest owner needs a guarantee that the host is not using specific +# firmware versions with known flaws. +# + +import argparse +from base64 import b64decode +from hashlib import sha256 +import hmac +import logging +import sys +import traceback + +log =3D logging.getLogger() + + +class AttestationFailedException(Exception): + pass + + +class UnsupportedUsageException(Exception): + pass + + +class ConfidentialVM(object): + + def __init__(self, + measurement=3DNone, + api_major=3DNone, + api_minor=3DNone, + build_id=3DNone, + policy=3DNone): + self.measurement =3D measurement + self.api_major =3D api_major + self.api_minor =3D api_minor + self.build_id =3D build_id + self.policy =3D policy + + self.firmware =3D None + self.tik =3D None + self.tek =3D None + + def load_tik_tek(self, tik_path, tek_path): + with open(tik_path, 'rb') as fh: + self.tik =3D fh.read() + log.debug("TIK(hex): %s", self.tik.hex()) + + if len(self.tik) !=3D 16: + raise UnsupportedUsageException( + "Expected 16 bytes in TIK file, but got %d" % len(self.tik= )) + + with open(tek_path, 'rb') as fh: + self.tek =3D fh.read() + log.debug("TEK(hex): %s", self.tek.hex()) + + if len(self.tek) !=3D 16: + raise UnsupportedUsageException( + "Expected 16 bytes in TEK file, but got %d" % len(self.tek= )) + + def load_tk(self, tk_path): + with open(tk_path, 'rb') as fh: + tk =3D fh.read() + + if len(tk) !=3D 32: + raise UnsupportedUsageException( + "Expected 32 bytes in TIK/TEK file, but got %d" % len(tk)) + + self.tek =3D tk[0:16] + self.tik =3D tk[16:32] + log.debug("TIK(hex): %s", self.tik.hex()) + log.debug("TEK(hex): %s", self.tek.hex()) + + def load_firmware(self, firmware_path): + with open(firmware_path, 'rb') as fh: + self.firmware =3D fh.read() + log.debug("Firmware(sha256): %s", sha256(self.firmware).hexdigest(= )) + + # Get the full set of measured launch data for the domain + # + # The measured data that the guest is initialized with is the concaten= ation + # of the following: + # + # - The firmware blob + def get_measured_data(self): + measured_data =3D self.firmware + log.debug("Measured-data(sha256): %s", + sha256(measured_data).hexdigest()) + return measured_data + + # Get the reported and computed launch measurements for the domain + # + # AMD Secure Encrypted Virtualization API , section 6.5: + # + # measurement =3D HMAC(0x04 || API_MAJOR || API_MINOR || BUILD || + # GCTX.POLICY || GCTX.LD || MNONCE; GCTX.TIK) + # + # Where GCTX.LD covers all the measured data the guest is initialized = with + # per get_measured_data(). + def get_measurements(self): + measurement =3D b64decode(self.measurement) + reported =3D measurement[0:32] + nonce =3D measurement[32:48] + + measured_data =3D self.get_measured_data() + msg =3D ( + bytes([0x4]) + + self.api_major.to_bytes(1, 'little') + + self.api_minor.to_bytes(1, 'little') + + self.build_id.to_bytes(1, 'little') + + self.policy.to_bytes(4, 'little') + + sha256(measured_data).digest() + + nonce + ) + log.debug("Measured-msg(hex): %s", msg.hex()) + + computed =3D hmac.new(self.tik, msg, 'sha256').digest() + + log.debug("Measurement reported(hex): %s", reported.hex()) + log.debug("Measurement computed(hex): %s", computed.hex()) + + return reported, computed + + def attest(self): + reported, computed =3D self.get_measurements() + + if reported !=3D computed: + raise AttestationFailedException( + "Measurement does not match, VM is not trustworthy") + + +def parse_command_line(): + parser =3D argparse.ArgumentParser( + description=3D'Validate guest AMD SEV launch measurement') + parser.add_argument('--debug', '-d', action=3D'store_true', + help=3D'Show debug information') + parser.add_argument('--quiet', '-q', action=3D'store_true', + help=3D'Do not display status') + + # Arguments related to the state of the launched guest + vmstate =3D parser.add_argument_group("Virtual machine launch state") + vmstate.add_argument('--measurement', '-m', required=3DTrue, + help=3D'Measurement for the running domain') + vmstate.add_argument('--api-major', type=3Dint, required=3DTrue, + help=3D'SEV API major version for the running dom= ain') + vmstate.add_argument('--api-minor', type=3Dint, required=3DTrue, + help=3D'SEV API minor version for the running dom= ain') + vmstate.add_argument('--build-id', type=3Dint, required=3DTrue, + help=3D'SEV build ID for the running domain') + vmstate.add_argument('--policy', type=3Dint, required=3DTrue, + help=3D'SEV policy for the running domain') + + # Arguments related to calculation of the expected launch measurement + vmconfig =3D parser.add_argument_group("Virtual machine config") + vmconfig.add_argument('--firmware', '-f', required=3DTrue, + help=3D'Path to the firmware binary') + vmconfig.add_argument('--tik', + help=3D'TIK file for domain') + vmconfig.add_argument('--tek', + help=3D'TEK file for domain') + vmconfig.add_argument('--tk', + help=3D'TEK/TIK combined file for domain') + + return parser.parse_args() + + +# Sanity check the set of CLI args specified provide enough info for us to= do +# the job +def check_usage(args): + if args.tk is not None: + if args.tik is not None or args.tek is not None: + raise UnsupportedUsageException( + "--tk is mutually exclusive with --tek/--tik") + else: + if args.tik is None or args.tek is None: + raise UnsupportedUsageException( + "Either --tk or both of --tek/--tik are required") + + +def attest(args): + cvm =3D ConfidentialVM(measurement=3Dargs.measurement, + api_major=3Dargs.api_major, + api_minor=3Dargs.api_minor, + build_id=3Dargs.build_id, + policy=3Dargs.policy) + + cvm.load_firmware(args.firmware) + + if args.tk is not None: + cvm.load_tk(args.tk) + else: + cvm.load_tik_tek(args.tik, args.tek) + + cvm.attest() + + if not args.quiet: + print("OK: Looks good to me") + +def main(): + args =3D parse_command_line() + if args.debug: + logging.basicConfig(level=3D"DEBUG") + formatter =3D logging.Formatter("[%(levelname)s]: %(message)s") + handler =3D log.handlers[0] + handler.setFormatter(formatter) + + try: + check_usage(args) + + attest(args) + + sys.exit(0) + except AttestationFailedException as e: + if args.debug: + traceback.print_tb(e.__traceback__) + if not args.quiet: + print("ERROR: %s" % e, file=3Dsys.stderr) + sys.exit(1) + except UnsupportedUsageException as e: + if args.debug: + traceback.print_tb(e.__traceback__) + if not args.quiet: + print("ERROR: %s" % e, file=3Dsys.stderr) + sys.exit(2) + except Exception as e: + if args.debug: + traceback.print_tb(e.__traceback__) + if not args.quiet: + print("ERROR: %s" % e, file=3Dsys.stderr) + sys.exit(3) + +if __name__ =3D=3D "__main__": + main() --=20 2.37.3 From nobody Fri Apr 26 03:07:47 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of redhat.com designates 170.10.133.124 as permitted sender) client-ip=170.10.133.124; envelope-from=libvir-list-bounces@redhat.com; helo=us-smtp-delivery-124.mimecast.com; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of redhat.com designates 170.10.133.124 as permitted sender) smtp.mailfrom=libvir-list-bounces@redhat.com; dmarc=pass(p=none dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1667831988; cv=none; d=zohomail.com; s=zohoarc; b=CLYfen/rAyfexEkwAy/kR2kGsgnhHtkhjV3gJ1CtT2qyvKyhJ5AnE+7nutJLnLTXoySU8R/Dn+8xb8B9Zt28IYiXLe4iyDADX5k4ldsTp6M/b9Q5iCttgGAueEacSkPq9LdmrvZuiA51VLAlqLvrOGXgT13xrIr6D9woAqZ4crM= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1667831988; h=Content-Type:Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:To; bh=iOpvam1gmiwQXosm8ijvEp/lSmIuryTenZq0iHc//aQ=; b=Cg+TUbHYap5fRHg4x8EoeJfUDom4x+FbLB/U0DSISDLN9N0DjrDR3Wv6yor0QR0Gv4PuB60ftn4JKwt8dlvZcgUmpWTvXYtO2UBVCwnT9DbG0Wl3Pbs8aDxOKOEUBq5CSnFriTmIwrAtWWDKQtDp8qn7Xeab81KnGAYeoyJYz6w= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of redhat.com designates 170.10.133.124 as permitted sender) smtp.mailfrom=libvir-list-bounces@redhat.com; dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) by mx.zohomail.com with SMTPS id 1667831988021453.4019563148539; Mon, 7 Nov 2022 06:39:48 -0800 (PST) Received: from mimecast-mx02.redhat.com (mimecast-mx02.redhat.com [66.187.233.88]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-218-RMJXuMliORq-8A91AZ6Jbw-1; Mon, 07 Nov 2022 09:39:40 -0500 Received: from smtp.corp.redhat.com (int-mx05.intmail.prod.int.rdu2.redhat.com [10.11.54.5]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 63603857D12; Mon, 7 Nov 2022 14:39:37 +0000 (UTC) Received: from mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (unknown [10.30.29.100]) by smtp.corp.redhat.com (Postfix) with ESMTP id 10F244EA48; Mon, 7 Nov 2022 14:39:37 +0000 (UTC) Received: from mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (localhost [IPv6:::1]) by mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (Postfix) with ESMTP id 47F221946A69; Mon, 7 Nov 2022 14:39:25 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx09.intmail.prod.int.rdu2.redhat.com [10.11.54.9]) by mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (Postfix) with ESMTP id 0E0281946A69 for ; Mon, 7 Nov 2022 14:39:25 +0000 (UTC) Received: by smtp.corp.redhat.com (Postfix) id 026934B3FCE; Mon, 7 Nov 2022 14:39:25 +0000 (UTC) Received: from localhost.localdomain.com (unknown [10.33.36.58]) by smtp.corp.redhat.com (Postfix) with ESMTP id BBAA34B3FC6; Mon, 7 Nov 2022 14:39:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1667831986; h=from:from:sender:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:list-id:list-help: list-unsubscribe:list-subscribe:list-post; bh=iOpvam1gmiwQXosm8ijvEp/lSmIuryTenZq0iHc//aQ=; b=Iv3HGbdg91IzY5NebA2VaKfytTBL4by9tWB7g5JS81j3w/fJT25jpBd4ns5WiV2Ybp59q6 OYNRUXMIaom3KTYG+qmhB/9KIyxPtVsYKmAOHagebBxYjDqrxGAaHe0F7JR/efe60UJxwH a34NeVkFku6OmT1kh+s/JIGrF+D4h6Q= X-MC-Unique: RMJXuMliORq-8A91AZ6Jbw-1 X-Original-To: libvir-list@listman.corp.redhat.com From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= To: libvir-list@redhat.com Subject: [libvirt PATCH v4 3/4] tools: load guest config from libvirt Date: Mon, 7 Nov 2022 14:39:09 +0000 Message-Id: <20221107143910.972928-4-berrange@redhat.com> In-Reply-To: <20221107143910.972928-1-berrange@redhat.com> References: <20221107143910.972928-1-berrange@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.1 on 10.11.54.9 X-BeenThere: libvir-list@redhat.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Development discussions about the libvirt library & tools List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: =?UTF-8?q?J=C3=A1n=20Tomko?= Errors-To: libvir-list-bounces@redhat.com Sender: "libvir-list" X-Scanned-By: MIMEDefang 3.1 on 10.11.54.5 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1667831989797100001 Accept information about a connection to libvirt and a guest on the command line. Talk to libvirt to obtain the running guest state and automatically detect as much configuration as possible. It will refuse to use a libvirt connection that is thought to be local to the current machine, as running this tool on the hypervisor itself is not considered secure. This can be overridden using the --insecure flag. When querying the guest, it will also analyse the XML configuration in an attempt to detect any options that are liable to be mistakes. For example the NVRAM being measured should not have a persistent varstore. Reviewed-by: J=C3=A1n Tomko Signed-off-by: Daniel P. Berrang=C3=A9 --- docs/manpages/virt-qemu-sev-validate.rst | 111 +++++++++++- tools/virt-qemu-sev-validate | 207 +++++++++++++++++++++-- 2 files changed, 304 insertions(+), 14 deletions(-) diff --git a/docs/manpages/virt-qemu-sev-validate.rst b/docs/manpages/virt-= qemu-sev-validate.rst index 0f6c64ba90..e2c4672a05 100644 --- a/docs/manpages/virt-qemu-sev-validate.rst +++ b/docs/manpages/virt-qemu-sev-validate.rst @@ -37,6 +37,12 @@ another virtual machine protected by AMD SEV that has al= ready had its launch measurement validated. Running this program on the virtualization host wil= l not produce an answer that can be trusted. =20 +If told to connect to libvirt, it will refuse to use a libvirt connection = that +is local to the machine, since that cannot be trusted. For the sake of tes= ting +or demonstration purposes, however, it can be forced to run in this scenar= io +using the ``--insecure`` flag. The result will, of course, still not be +trustworthy. + OPTIONS =3D=3D=3D=3D=3D=3D=3D =20 @@ -115,6 +121,43 @@ size, with the first 16 bytes containing the TEK and t= he last 16 bytes containing the TIK. This is mutually exclusive with the ``--tik`` and ``-= -tek`` arguments. =20 +Libvirt options +--------------- + +These options are used when connecting to libvirt to automatically obtain +state and configuration information about the domain to be attested. + +``-c``, ``--connect URI`` + +Libvirt connection URI. For the validation to be trustworthy this must be = a URI +resolving to a remote virtualization host. This requirement can be overrid= den +using the ``--insecure`` argument. + +``-o``, ``--domain ID|NAME|UUID`` + +Domain ID, or domain name or domain UUID. Used to identify which libvirt d= omain +is to have its launch measured. The domain must be running, and would usua= lly +have been started in a paused state, to allow validation to be performed b= efore +guest CPUs begin execution. + +``-i``, ``--insecure`` + +Proceed even if usage scenario is known to be insecure. This allows the pr= ogram +to connect to a local libvirt hypervisor and rely on file content from the +virtualization host. It also allows the validation to proceed even if the +virtual machine CPUs are not in the initial paused state. The result of the +validation must not be trusted. + +``-g``, ``--ignore-config`` + +Do not attempt to sanity check the domain config. The default behaviour is= to +print out errors if identifying configuration elements in the guest XML th= at +would invalidate the launch measurement. This can help the guest owner to +understand any configuration mistakes that have been made. If the +``--ignore-config`` argument is given, this sanity checking of configurati= on +will be skipped. The result is that the validation will likely be reported= as +failed. + EXAMPLES =3D=3D=3D=3D=3D=3D=3D=3D =20 @@ -139,6 +182,46 @@ Validate the measurement of a SEV guest booting from d= isk: --build-id 13 \ --policy 3 =20 +Fetch from remote libvirt +------------------------- + +This scenario allows fetching certain data from a remote hypervisor via a +connection to libvirt. It will aid in debugging by analysing the guest +configuration and reporting anything that could invalidate the measurement +of the guest. This usage model is considered secure, because the limited +information obtained from the untrusted hypervisor cannot be used to change +the result. + +Validate the measurement of a SEV guest booting from disk: + +:: + + # virt-qemu-sev-validate \ + --connect qemu+ssh://root@some.remote.host/system \ + --firmware OVMF.sev.fd \ + --tk this-guest-tk.bin \ + --domain fedora34x86_64 + +Fetch from local libvirt +------------------------ + +This scenario allows fetching all data from the local hypervisor via a +connection to libvirt. It is only to be used for the purpose of testing, +debugging, or demonstrations, because running on the local hypervisor is n= ot +a secure scenario. To enable this usage, the ``--insecure`` flag must be +specified. Given a pointer to the libvirt guest to validate, all informati= on +needed to perform a validation, except the TIK/TEK pair can be acquired +automatically. + +Validate the measurement of a SEV guest booting from disk: + +:: + + # virt-qemu-sev-validate \ + --insecure \ + --tk this-guest-tk.bin \ + --domain fedora34x86_64 + EXIT STATUS =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D =20 @@ -158,7 +241,33 @@ be set: The way in which this program has been invoked prevent it from being abl= e to validate the launch measurement. =20 -* **3** - *unexpected error occurred in the code* +* **3** - *Usage scenario is not secure* + + The way in which this program has been invoked means that the result of = any + launch measurement validation will not be secure. + + The program can be reinvoked with ``--insecure`` argument to force a + validation, however, the results of this should not be trusted. This sho= uld + only be used for testing, debugging or demonstration purposes, never in a + production deployment. + +* **4** - *Domain has incorrect configuration to be measured* + + The way in which the guest has been configured prevent this program from= being + able to validate the launch measurement. Note that in general the guest + configuration reported by the hypervisor is not trustworthy, so it is + possible this error could be a false positive designed to cause a denial= of + service. + + This program can be reinvoked with the ``--ignore-config`` argument to s= kip + the sanity checks on the domain XML. This will likely result in it faili= ng + with an exit code of **1** indicating the measurement is invalid + +* **5** - *Domain is in incorrect state to be measured* + + The domain has to be running in order to validate a launch measurement. + +* **6** - *unexpected error occurred in the code* =20 A logic flaw in this program means it is unable to complete the validati= on of the measurement. This is a bug which should be reported to the maintaine= rs. diff --git a/tools/virt-qemu-sev-validate b/tools/virt-qemu-sev-validate index 7ff54e7623..31c739c10f 100755 --- a/tools/virt-qemu-sev-validate +++ b/tools/virt-qemu-sev-validate @@ -39,9 +39,14 @@ from base64 import b64decode from hashlib import sha256 import hmac import logging +import re +import socket import sys import traceback =20 +from lxml import etree +import libvirt + log =3D logging.getLogger() =20 =20 @@ -53,6 +58,18 @@ class UnsupportedUsageException(Exception): pass =20 =20 +class InsecureUsageException(Exception): + pass + + +class IncorrectConfigException(Exception): + pass + + +class InvalidStateException(Exception): + pass + + class ConfidentialVM(object): =20 def __init__(self, @@ -159,6 +176,108 @@ class ConfidentialVM(object): "Measurement does not match, VM is not trustworthy") =20 =20 +class LibvirtConfidentialVM(ConfidentialVM): + def __init__(self, **kwargs): + super().__init__(**kwargs) + + self.conn =3D None + self.dom =3D None + + def check_domain(self, doc, secure): + ls =3D doc.xpath("/domain/launchSecurity[@type=3D'sev']") + if len(ls) !=3D 1: + raise IncorrectConfigException( + "Domain is not configured with SEV launch security") + + dh =3D doc.xpath("/domain/launchSecurity[@type=3D'sev']/dhCert") + if len(dh) !=3D 1: + raise IncorrectConfigException( + "Domain must have SEV owner cert to validate measurement") + + session =3D doc.xpath("/domain/launchSecurity[@type=3D'sev']/sessi= on") + if len(session) !=3D 1: + raise IncorrectConfigException( + "Domain must have SEV session data to validate measurement= ") + + nvramnodes =3D doc.xpath("/domain/os/nvram") + if len(nvramnodes) !=3D 0 and secure: + raise InsecureUsageException( + "Domain firmware with NVRAM cannot be securely measured") + + loadernodes =3D doc.xpath("/domain/os/loader") + if len(loadernodes) !=3D 1: + raise IncorrectConfigException( + "Domain must have one firmware path") + + def load_domain(self, uri, id_name_uuid, secure, ignore_config): + self.conn =3D libvirt.open(uri) + + remote =3D socket.gethostname() !=3D self.conn.getHostname() + if not remote and secure: + raise InsecureUsageException( + "running locally on the hypervisor host is not secure") + + if re.match(r'^\d+$', id_name_uuid): + self.dom =3D self.conn.lookupByID(int(id_name_uuid)) + elif re.match(r'^[-a-f0-9]+$', id_name_uuid): + self.dom =3D self.conn.lookupByUUIDString(id_name_uuid) + else: + self.dom =3D self.conn.lookupByName(id_name_uuid) + + log.debug("VM: id=3D%d name=3D%s uuid=3D%s", + self.dom.ID(), self.dom.name(), self.dom.UUIDString()) + + if not self.dom.isActive(): + raise InvalidStateException( + "Domain must be running to validate measurement") + + state =3D self.dom.info()[0] + if state !=3D libvirt.VIR_DOMAIN_PAUSED and secure: + raise InvalidStateException( + "Domain must be paused to validate measurement") + + xml =3D self.dom.XMLDesc() + + doc =3D etree.fromstring(xml) + if not ignore_config: + self.check_domain(doc, secure) + + # See comments at top of file wrt why we are OK to trust the + # sev-api-major, sev-api-minor, sev-build-id and sev-policy data + # reported by the host + sevinfo =3D self.dom.launchSecurityInfo() + + if "sev-api-major" not in sevinfo: + raise UnsupportedUsageException( + "'api-major' not reported in domain launch security info") + + if self.measurement is None: + self.measurement =3D sevinfo["sev-measurement"] + if self.api_major is None: + self.api_major =3D sevinfo["sev-api-major"] + if self.api_minor is None: + self.api_minor =3D sevinfo["sev-api-minor"] + if self.build_id is None: + self.build_id =3D sevinfo["sev-build-id"] + if self.policy is None: + self.policy =3D sevinfo["sev-policy"] + + if self.firmware is None: + if remote: + raise UnsupportedUsageException( + "Cannot access firmware path remotely") + if secure: + raise InsecureUsageException( + "Using firmware path from XML is not secure") + + loadernodes =3D doc.xpath("/domain/os/loader") + if len(loadernodes) =3D=3D 0: + raise UnsupportedUsageException( + "--firmware not specified and no firmware path found") + + self.load_firmware(loadernodes[0].text) + + def parse_command_line(): parser =3D argparse.ArgumentParser( description=3D'Validate guest AMD SEV launch measurement') @@ -169,20 +288,20 @@ def parse_command_line(): =20 # Arguments related to the state of the launched guest vmstate =3D parser.add_argument_group("Virtual machine launch state") - vmstate.add_argument('--measurement', '-m', required=3DTrue, + vmstate.add_argument('--measurement', '-m', help=3D'Measurement for the running domain') - vmstate.add_argument('--api-major', type=3Dint, required=3DTrue, + vmstate.add_argument('--api-major', type=3Dint, help=3D'SEV API major version for the running dom= ain') - vmstate.add_argument('--api-minor', type=3Dint, required=3DTrue, + vmstate.add_argument('--api-minor', type=3Dint, help=3D'SEV API minor version for the running dom= ain') - vmstate.add_argument('--build-id', type=3Dint, required=3DTrue, + vmstate.add_argument('--build-id', type=3Dint, help=3D'SEV build ID for the running domain') - vmstate.add_argument('--policy', type=3Dint, required=3DTrue, + vmstate.add_argument('--policy', type=3Dint, help=3D'SEV policy for the running domain') =20 # Arguments related to calculation of the expected launch measurement vmconfig =3D parser.add_argument_group("Virtual machine config") - vmconfig.add_argument('--firmware', '-f', required=3DTrue, + vmconfig.add_argument('--firmware', '-f', help=3D'Path to the firmware binary') vmconfig.add_argument('--tik', help=3D'TIK file for domain') @@ -191,6 +310,17 @@ def parse_command_line(): vmconfig.add_argument('--tk', help=3D'TEK/TIK combined file for domain') =20 + # Arguments related to the connection to libvirt + vmconn =3D parser.add_argument_group("Libvirt guest connection") + vmconn.add_argument('--connect', '-c', default=3D"qemu:///system", + help=3D'libvirt connection URI') + vmconn.add_argument('--domain', '-o', + help=3D'domain ID / Name / UUID') + vmconn.add_argument('--insecure', '-i', action=3D'store_true', + help=3D'Proceed even if usage scenario is insecure= ') + vmconn.add_argument('--ignore-config', '-g', action=3D'store_true', + help=3D'Do not attempt to sanity check the guest c= onfig') + return parser.parse_args() =20 =20 @@ -206,21 +336,60 @@ def check_usage(args): raise UnsupportedUsageException( "Either --tk or both of --tek/--tik are required") =20 + if args.domain is None: + if args.measurement is None: + raise UnsupportedUsageException( + "Either --measurement or --domain is required") + + if args.api_major is None: + raise UnsupportedUsageException( + "Either --api-major or --domain is required") + + if args.api_minor is None: + raise UnsupportedUsageException( + "Either --api-minor or --domain is required") + + if args.build_id is None: + raise UnsupportedUsageException( + "Either --build-id or --domain is required") + + if args.policy is None: + raise UnsupportedUsageException( + "Either --policy or --domain is required") + + if args.firmware is None: + raise UnsupportedUsageException( + "Either --firmware or --domain is required") + =20 def attest(args): - cvm =3D ConfidentialVM(measurement=3Dargs.measurement, - api_major=3Dargs.api_major, - api_minor=3Dargs.api_minor, - build_id=3Dargs.build_id, - policy=3Dargs.policy) + if args.domain is None: + cvm =3D ConfidentialVM(measurement=3Dargs.measurement, + api_major=3Dargs.api_major, + api_minor=3Dargs.api_minor, + build_id=3Dargs.build_id, + policy=3Dargs.policy) + else: + cvm =3D LibvirtConfidentialVM(measurement=3Dargs.measurement, + api_major=3Dargs.api_major, + api_minor=3Dargs.api_minor, + build_id=3Dargs.build_id, + policy=3Dargs.policy) =20 - cvm.load_firmware(args.firmware) + if args.firmware is not None: + cvm.load_firmware(args.firmware) =20 if args.tk is not None: cvm.load_tk(args.tk) else: cvm.load_tik_tek(args.tik, args.tek) =20 + if args.domain is not None: + cvm.load_domain(args.connect, + args.domain, + not args.insecure, + args.ignore_config) + cvm.attest() =20 if not args.quiet: @@ -252,12 +421,24 @@ def main(): if not args.quiet: print("ERROR: %s" % e, file=3Dsys.stderr) sys.exit(2) + except InsecureUsageException as e: + if not args.quiet: + print("ERROR: %s" % e, file=3Dsys.stderr) + sys.exit(3) + except IncorrectConfigException as e: + if not args.quiet: + print("ERROR: %s" % e, file=3Dsys.stderr) + sys.exit(4) + except InvalidStateException as e: + if not args.quiet: + print("ERROR: %s" % e, file=3Dsys.stderr) + sys.exit(5) except Exception as e: if args.debug: traceback.print_tb(e.__traceback__) if not args.quiet: print("ERROR: %s" % e, file=3Dsys.stderr) - sys.exit(3) + sys.exit(6) =20 if __name__ =3D=3D "__main__": main() --=20 2.37.3 From nobody Fri Apr 26 03:07:47 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of redhat.com designates 170.10.133.124 as permitted sender) client-ip=170.10.133.124; envelope-from=libvir-list-bounces@redhat.com; helo=us-smtp-delivery-124.mimecast.com; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of redhat.com designates 170.10.133.124 as permitted sender) smtp.mailfrom=libvir-list-bounces@redhat.com; dmarc=pass(p=none dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1667832046; cv=none; d=zohomail.com; s=zohoarc; b=dT0rhRpSJtSc3BGBtZ0fWwQkNhYLSbFxuE8ikoRN74700GFrYX2T+rBgNgqb26/gvNH52BCq5yHN+K1pOme38QWLaw3IRFg7rQp4DoAh3Ex1okBUrJEw9exoX9DkXhOZeflwsZwlRcTkBuJznQiPZV+1VHHkq8iVBK/FfHNnrVo= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1667832046; h=Content-Type:Content-Transfer-Encoding:Date:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:To; bh=yaXWC87cUbxAUfeJM1gdBir8NPrqsSKorK3DuFVbYVM=; b=ZggMyjyD8Lo2N2nxvBWFIk9APHF0J4wO5mlHoKhZ4P3Rbj5gitsqoDS4gPyyraZtPRowMeS7idKnvEpfztVJrlcyv3yapdDRxuBH8rpz8lXshk383mX9qF/9znimyNekGxxPbunISTmS8F7geABveN6CWjFvmqC+dNSHY+wV6vo= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of redhat.com designates 170.10.133.124 as permitted sender) smtp.mailfrom=libvir-list-bounces@redhat.com; dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) by mx.zohomail.com with SMTPS id 1667832046840135.27580643373085; Mon, 7 Nov 2022 06:40:46 -0800 (PST) Received: from mimecast-mx02.redhat.com (mx3-rdu2.redhat.com [66.187.233.73]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-620-jrzUMu3oPZmm4dJe6D-YYQ-1; Mon, 07 Nov 2022 09:39:46 -0500 Received: from smtp.corp.redhat.com (int-mx09.intmail.prod.int.rdu2.redhat.com [10.11.54.9]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id CF92E1C0BC67; Mon, 7 Nov 2022 14:39:42 +0000 (UTC) Received: from mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (unknown [10.30.29.100]) by smtp.corp.redhat.com (Postfix) with ESMTP id B81484B3FE3; Mon, 7 Nov 2022 14:39:42 +0000 (UTC) Received: from mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (localhost [IPv6:::1]) by mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (Postfix) with ESMTP id 976D81946589; Mon, 7 Nov 2022 14:39:32 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx09.intmail.prod.int.rdu2.redhat.com [10.11.54.9]) by mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (Postfix) with ESMTP id 061EF194658F for ; Mon, 7 Nov 2022 14:39:26 +0000 (UTC) Received: by smtp.corp.redhat.com (Postfix) id EC6CA4B3FCD; Mon, 7 Nov 2022 14:39:25 +0000 (UTC) Received: from localhost.localdomain.com (unknown [10.33.36.58]) by smtp.corp.redhat.com (Postfix) with ESMTP id 44A954B3FC6; Mon, 7 Nov 2022 14:39:25 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1667832045; h=from:from:sender:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:list-id:list-help: list-unsubscribe:list-subscribe:list-post; bh=yaXWC87cUbxAUfeJM1gdBir8NPrqsSKorK3DuFVbYVM=; b=XZW4BV+PEz0v/HN+MrV8r2LXlZGxTiQspkGt+ZQKdcvd13t8Y10voJXRVko22guZYSheYq 22pI8g6JyrkSgK6Vh6pIp5o1iUHNY2EOd8ZOjp+WNGMgAXXs07VxhNCOh1ENNmOMFHU0EV Ic0UB/6IIV5XiWCNnh78Az3/wWY0CiQ= X-MC-Unique: jrzUMu3oPZmm4dJe6D-YYQ-1 X-Original-To: libvir-list@listman.corp.redhat.com From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= To: libvir-list@redhat.com Subject: [libvirt PATCH v4 4/4] tools: support validating SEV direct kernel boot measurements Date: Mon, 7 Nov 2022 14:39:10 +0000 Message-Id: <20221107143910.972928-5-berrange@redhat.com> In-Reply-To: <20221107143910.972928-1-berrange@redhat.com> References: <20221107143910.972928-1-berrange@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.1 on 10.11.54.9 X-BeenThere: libvir-list@redhat.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Development discussions about the libvirt library & tools List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: libvir-list-bounces@redhat.com Sender: "libvir-list" X-Scanned-By: MIMEDefang 3.1 on 10.11.54.9 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1667832048088100003 When doing direct kernel boot we need to include the kernel, initrd and cmdline in the measurement. Signed-off-by: Daniel P. Berrang=C3=A9 --- docs/manpages/virt-qemu-sev-validate.rst | 43 +++++++++ tools/virt-qemu-sev-validate | 113 ++++++++++++++++++++++- 2 files changed, 155 insertions(+), 1 deletion(-) diff --git a/docs/manpages/virt-qemu-sev-validate.rst b/docs/manpages/virt-= qemu-sev-validate.rst index e2c4672a05..e8a868f5a8 100644 --- a/docs/manpages/virt-qemu-sev-validate.rst +++ b/docs/manpages/virt-qemu-sev-validate.rst @@ -102,6 +102,20 @@ initialize AMD SEV. For the validation to be trustwort= hy it important that the firmware build used has no support for loading non-volatile variables from NVRAM, even if NVRAM is expose to the guest. =20 +``-k PATH``, ``--kernel=3DPATH`` + +Path to the kernel binary if doing direct kernel boot. + +``-r PATH``, ``--initrd=3DPATH`` + +Path to the initrd binary if doing direct kernel boot. Defaults to zero le= ngth +content if omitted. + +``-e STRING``, ``--cmdline=3DSTRING`` + +String containing any kernel command line parameters used during boot of t= he +domain. Defaults to the empty string if omitted. + ``--tik PATH`` =20 TIK file for domain. This file must be exactly 16 bytes in size and contai= ns the @@ -182,6 +196,22 @@ Validate the measurement of a SEV guest booting from d= isk: --build-id 13 \ --policy 3 =20 +Validate the measurement of a SEV guest with direct kernel boot: + +:: + + # virt-dom-sev-validate \ + --firmware OVMF.sev.fd \ + --kernel vmlinuz-5.11.12 \ + --initrd initramfs-5.11.12 \ + --cmdline "root=3D/dev/vda1" \ + --tk this-guest-tk.bin \ + --measurement Zs2pf19ubFSafpZ2WKkwquXvACx9Wt/BV+eJwQ/taO8jhyIj/F8sw= FrybR1fZ2ID \ + --api-major 0 \ + --api-minor 24 \ + --build-id 13 \ + --policy 3 + Fetch from remote libvirt ------------------------- =20 @@ -202,6 +232,19 @@ Validate the measurement of a SEV guest booting from d= isk: --tk this-guest-tk.bin \ --domain fedora34x86_64 =20 +Validate the measurement of a SEV guest with direct kernel boot: + +:: + + # virt-dom-sev-validate \ + --connect qemu+ssh://root@some.remote.host/system \ + --firmware OVMF.sev.fd \ + --kernel vmlinuz-5.11.12 \ + --initrd initramfs-5.11.12 \ + --cmdline "root=3D/dev/vda1" \ + --tk this-guest-tk.bin \ + --domain fedora34x86_64 + Fetch from local libvirt ------------------------ =20 diff --git a/tools/virt-qemu-sev-validate b/tools/virt-qemu-sev-validate index 31c739c10f..b978c3eb3d 100755 --- a/tools/virt-qemu-sev-validate +++ b/tools/virt-qemu-sev-validate @@ -34,6 +34,7 @@ # firmware versions with known flaws. # =20 +import abc import argparse from base64 import b64decode from hashlib import sha256 @@ -43,6 +44,7 @@ import re import socket import sys import traceback +from uuid import UUID =20 from lxml import etree import libvirt @@ -70,6 +72,91 @@ class InvalidStateException(Exception): pass =20 =20 +class GUIDTable(abc.ABC): + GUID_LEN =3D 16 + + def __init__(self, guid, lenlen=3D2): + self.guid =3D guid + self.lenlen =3D lenlen + + @abc.abstractmethod + def entries(self): + pass + + def build_entry(self, guid, payload, lenlen): + dummylen =3D int(0).to_bytes(lenlen, 'little') + entry =3D bytearray(guid + dummylen + payload) + + lenle =3D len(entry).to_bytes(lenlen, 'little') + entry[self.GUID_LEN:(self.GUID_LEN + lenlen)] =3D lenle + + return bytes(entry) + + def build(self): + payload =3D self.entries() + + if len(payload) =3D=3D 0: + return bytes([]) + + dummylen =3D int(0).to_bytes(self.lenlen, 'little') + table =3D bytearray(self.guid + dummylen + payload) + + guidlen =3D len(table).to_bytes(self.lenlen, 'little') + table[self.GUID_LEN:(self.GUID_LEN + self.lenlen)] =3D guidlen + + pad =3D 16 - (len(table) % 16) + table +=3D bytes([0]) * pad + + log.debug("Table(hex): %s", bytes(table).hex()) + return bytes(table) + + +class KernelTable(GUIDTable): + + TABLE_GUID =3D UUID('{9438d606-4f22-4cc9-b479-a793-d411fd21}').bytes_le + KERNEL_GUID =3D UUID('{4de79437-abd2-427f-b835-d5b1-72d2045b}').bytes_= le + INITRD_GUID =3D UUID('{44baf731-3a2f-4bd7-9af1-41e2-9169781d}').bytes_= le + CMDLINE_GUID =3D UUID('{97d02dd8-bd20-4c94-aa78-e771-4d36ab2a}').bytes= _le + + def __init__(self): + super().__init__(guid=3Dself.TABLE_GUID, + lenlen=3D2) + + self.kernel =3D None + self.initrd =3D None + self.cmdline =3D None + + def load_kernel(self, path): + with open(path, "rb") as fh: + self.kernel =3D sha256(fh.read()).digest() + + def load_initrd(self, path): + with open(path, "rb") as fh: + self.initrd =3D sha256(fh.read()).digest() + + def load_cmdline(self, val): + self.cmdline =3D sha256(val.encode("utf8") + bytes([0])).digest() + + def entries(self): + entries =3D bytes([]) + if self.kernel is None: + return entries + + if self.initrd is None: + self.initrd =3D sha256(bytes([])).digest() + if self.cmdline is None: + self.cmdline =3D sha256(bytes([0])).digest() + + log.debug("Kernel(sha256): %s", self.kernel.hex()) + log.debug("Initrd(sha256): %s", self.initrd.hex()) + log.debug("Cmdline(sha256): %s", self.cmdline.hex()) + entries +=3D self.build_entry(self.CMDLINE_GUID, self.cmdline, 2) + entries +=3D self.build_entry(self.INITRD_GUID, self.initrd, 2) + entries +=3D self.build_entry(self.KERNEL_GUID, self.kernel, 2) + + return entries + + class ConfidentialVM(object): =20 def __init__(self, @@ -88,6 +175,8 @@ class ConfidentialVM(object): self.tik =3D None self.tek =3D None =20 + self.kernel_table =3D KernelTable() + def load_tik_tek(self, tik_path, tek_path): with open(tik_path, 'rb') as fh: self.tik =3D fh.read() @@ -129,8 +218,10 @@ class ConfidentialVM(object): # of the following: # # - The firmware blob + # - The kernel GUID table def get_measured_data(self): - measured_data =3D self.firmware + measured_data =3D (self.firmware + + self.kernel_table.build()) log.debug("Measured-data(sha256): %s", sha256(measured_data).hexdigest()) return measured_data @@ -303,6 +394,12 @@ def parse_command_line(): vmconfig =3D parser.add_argument_group("Virtual machine config") vmconfig.add_argument('--firmware', '-f', help=3D'Path to the firmware binary') + vmconfig.add_argument('--kernel', '-k', + help=3D'Path to the kernel binary') + vmconfig.add_argument('--initrd', '-r', + help=3D'Path to the initrd binary') + vmconfig.add_argument('--cmdline', '-e', + help=3D'Cmdline string booted with') vmconfig.add_argument('--tik', help=3D'TIK file for domain') vmconfig.add_argument('--tek', @@ -361,6 +458,11 @@ def check_usage(args): raise UnsupportedUsageException( "Either --firmware or --domain is required") =20 + if args.kernel is None: + if args.initrd is not None or args.cmdline is not None: + raise UnsupportedUsageException( + "--initrd/--cmdline require --kernel") + =20 def attest(args): if args.domain is None: @@ -384,6 +486,15 @@ def attest(args): else: cvm.load_tik_tek(args.tik, args.tek) =20 + if args.kernel is not None: + cvm.kernel_table.load_kernel(args.kernel) + + if args.initrd is not None: + cvm.kernel_table.load_initrd(args.initrd) + + if args.cmdline is not None: + cvm.kernel_table.load_cmdline(args.cmdline) + if args.domain is not None: cvm.load_domain(args.connect, args.domain, --=20 2.37.3