File s390-tools-sles15sp4-pvattest-tools-Add-tool-fo... of Package s390-tools.30980

Overview Repositories Revisions Requests Users Attributes Meta

File s390-tools-sles15sp4-pvattest-tools-Add-tool-for-attestation.patch of Package s390-tools.30980

Subject: [PATCH] [FEAT VS2038] pvattest/tools: Add tool for attestation
From: Steffen Eiden <seiden@linux.ibm.com>

Summary:     pvattest: Create, perform, and verify attestation measurements
Description: pvattest is a tool to attest an IBM Secure Execution guest.
             
             In a trusted environment, one can create a request using
             `pvattest create`. To get a measurement of an untrusted
             IBM Secure Execution guest call 'pvattest perform'.
             Again in a trusted environment, call 'pvattest verify'
             to verify that the measurement is the expected one.
             
             The tool runs on s390 and x86.
             It has the same requirements like libpv and therefore
             requires openssl v1.1.1+, glib2.56+, and libcurl.
             Additionally, to measure, the linux kernel must provide
             the Ultravisor userspace interface `uvdevice` at /dev/uv
             and must be executed  on an IBM Secure Execution guest on
             hardware with Ultravisor attestation support,
             like IBM z16 or later.
Upstream-ID: 26148740dfe14a33a01f1f75008c81fbafc8ed13
Problem-ID:  VS2038

Upstream-Description:

pvattest/tools: Add tool for attestation

Adds:
               * extract_hdr_from_image
                 a bash script to extract the SE header from an SE image.

Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
             Acked-by: Marc Hartmayer <mhartmay@linux.ibm.com>
             Signed-off-by: Jan Hoeppner <hoeppner@linux.ibm.com>

Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
---
 .gitignore                   |    1 
 pvattest/Makefile            |    2 
 pvattest/tools/Makefile      |    5 ++
 pvattest/tools/pvextract-hdr |   89 +++++++++++++++++++++++++++++++++++++++++++
 4 files changed, 96 insertions(+), 1 deletion(-)

--- a/.gitignore
+++ b/.gitignore
@@ -65,6 +65,7 @@ mon_tools/mon_fsstatd
 mon_tools/mon_procd
 osasnmpd/osasnmpd
 pvattest/src/pvattest
+pvattest/tools/exchange_info
 qetharp/qetharp
 qethqoat/qethqoat
 systemd/cpacfstatsd.service
--- a/pvattest/Makefile
+++ b/pvattest/Makefile
@@ -4,7 +4,7 @@ include ../common.mak
 .DEFAULT_GOAL := all
 
 PKGDATADIR := "$(DESTDIR)$(TOOLS_DATADIR)/pvattest"
-SUBDIRS := src man
+SUBDIRS := src man tools
 RECURSIVE_TARGETS := all-recursive clean-recursive install-recursive
 
 all: all-recursive
--- /dev/null
+++ b/pvattest/tools/Makefile
@@ -0,0 +1,5 @@
+include ../../common.mak
+
+install:
+	$(INSTALL) -d -m 755 $(DESTDIR)$(USRBINDIR)
+	$(INSTALL) -g $(GROUP) -o $(OWNER) -m 755 pvextract-hdr "$(DESTDIR)$(USRBINDIR)"
--- /dev/null
+++ b/pvattest/tools/pvextract-hdr
@@ -0,0 +1,89 @@
+#!/bin/bash
+#
+# pvextract_hdr - extract an IBM Secure Execution header from the Image
+#
+# Sample:
+# ./pvextract-hdr -o sehdr.bin se-image.bin
+#
+# Copyright IBM Corp. 2022
+#
+# s390-tools is free software; you can redistribute it and/or modify
+# it under the terms of the MIT license. See LICENSE for details.
+
+set -o pipefail
+set -o nounset
+set -e
+
+def_output="sehdr.bin"
+def_skip=0x14
+def_len=0x4
+
+usage() {
+	cat <<-EOF
+		Usage: $(basename "$0") [-o ${def_output}] [-s ${def_skip}] [-l ${def_len}] FILE
+
+		Extract the header of the SE-image located in FILE.
+		By default ${def_skip} pages will be skipped until starting to search
+		for the header. By default the search will be stopped after ${def_len} pages.
+		'${def_output}' is the default output file name.
+	EOF
+}
+
+function check_file() {
+	[ -e "$1" ] ||
+		{ echo "ERROR: File '$1' not found" >&2 && exit 1; }
+}
+
+function check_hdr_ver() {
+	local hdr_start="$1"
+	local input="$2"
+	xxd -s $((hdr_start + 8)) -l 4 "$input" | grep -q "000 0100" ||
+		{ echo -n "WARNING: unknown hdr version " &&
+			xxd -s $((hdr_start + 8)) -l 4 "$input" | awk '{print "0x" $2 $3}'; }
+}
+
+output=${def_output}
+parsed_skip=${def_skip}
+parsed_len=${def_len}
+# the last argument must be the input file
+input="${*: -1}"
+while getopts 'o:s:l:h' OPTION; do
+	case "$OPTION" in
+	o) output="$OPTARG" ;;
+	s) parsed_skip="$OPTARG" ;;
+	l) parsed_len="$OPTARG" ;;
+	h)
+		usage
+		exit 0
+		;;
+	:)
+		echo "ERROR: Must supply an argument to -$OPTARG." >&2
+		exit 1
+		;;
+	*)
+		usage
+		exit 1
+		;;
+	esac
+done
+
+#argument specify pages; convert to bytes
+skip=$((parsed_skip * 0x1000))
+len=$((parsed_len * 0x1000))
+
+if [ $# -eq 0 ]; then
+	echo "ERROR: Input not set. Use '$(basename "$0") [FILE]' to specify the Input file" >&2
+	exit 1
+fi
+
+check_file "$input"
+hdr_start=$(xxd -s $((skip)) -l $((len)) "${input}" | grep IBMSecEx || { echo ERROR: "${input} does not contain an SE header." >&2 && exit 1; })
+hdr_start=$(echo "${hdr_start}" | awk '{print "0x" $1}' | cut -c 1-10)
+echo "SE header found at offset ${hdr_start}"
+
+check_hdr_ver "$hdr_start" "$input"
+
+size=$(xxd -s $((hdr_start + 12)) -l 4 "${input}" | awk 'NR==1 {print "0x" $2 $3}')
+
+dd if="${input}" of="${output}" bs=1 count=$((size)) skip=$((hdr_start)) status=none
+echo "SE header written to '${output}' ($((size)) bytes)"

Places

File s390-tools-sles15sp4-pvattest-tools-Add-tool-for-attestation.patch of Package s390-tools.30980

Places