Re: SVSM initiated early attestation / guest secrets injection

["Daniel P. Berrangé" <berrange@redhat.com>]

On Mon, Jan 16, 2023 at 05:55:52PM +0100, Jörg Rödel wrote:
> On Sat, Jan 14, 2023 at 01:22:41PM -0500, James Bottomley wrote:
> > On Sat, 2023-01-14 at 18:08 +0100, Jörg Rödel wrote:
> > 
> > [...]
> > > As James also said, the measurement to unlock secrets need to include
> > > all software/data components up to the point where the encrypted disk
> > > gets mounted.
> > 
> > Well, we have a prototype in IBM Research using keylime to do this
> > based on the vTPM measurements.  We currently bring up a network
> > interface inside the initrd to run the keylime agent, but if you're
> > already inventing a non-network method for attestation, there's no
> > reason we couldn't transport TPM quotes over it as well.
> 
> So you are unlocking the disk via keylime remote attestation. This means
> you need a measured initrd, right?
> 
> We were thinking about doing disk-unlocking via TPM in Grub, but that
> has the problem that we need to securely deploy the TPM state at SVSM
> init-time.

IMHO it is undesirable to build a reliance on a specific bootloader.

My desire is that we have the stateful TPM in SVSM, such that once
the UEFI firmware starts everything functions identically to how
it would in bare metal or non-confidential VMs with a TPM. eg the
ability to use all the normal Linux tools, and especially the
standard systemd integration with LUKS and TPMs.


With regards,
Daniel
-- 
|: https://berrange.com      -o-    https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org         -o-            https://fstop138.berrange.com :|
|: https://entangle-photo.org    -o-    https://www.instagram.com/dberrange :|