Re: SVSM initiated early attestation / guest secrets injection

["Daniel P. Berrangé" <berrange@redhat.com>]

On Fri, Jan 20, 2023 at 09:37:35AM +0100, Jörg Rödel wrote:
> On Thu, Jan 19, 2023 at 04:29:23PM -0500, James Bottomley wrote:
> > How can they stay there?  Even if the SVSM is the point of first
> > contact to receive the secret, it must give the secret to higher VMPLs
> > to try the mount, so the higher VMPLs have to destroy the secret they
> > were given on failure.
> 
> My thinking was that the SVSM will only hand out the secrets once the
> code in higher VMPLs has proven itself to be trusted. But it is possible
> for an attacker to create an image with the expected parts to get the
> measurements right and then use a fall-back mount if decryption fails to
> steal the secret.

With a vTPM, and systemd-pcrphase.service, it is possible to seal
secrets to prevent such an attack, by including phase=initrd in
the sealing PCRs. IOW, nothing after the initrd can unseal the
secrets, even if a different filesystem mount was substituted.

Secrets that are needed /after/ the root FS is mounted (eg SSH
host key, Apache HTTP certs) can be sealed with a PCR set that
covers the LUKS master key hash, so that they can only be acccessed
if the correct rootfs was unlocked.

In the vTPM case, the guest owner is deciding policy when they
seal secrets to the vTPM during guest provisioning initially.
If we try to support a scenario without a vTPM, then the guest
owner has to determine policy by using a carefully built initrd
that does not do any fallbacks, and they have to rely on having
a known firmware with a particular set to certs enrolled, which
has support implications for public clouds. Much less flexible.
 
> But such mount fallbacks a generally a bad idea in a CVM.

Yep, but hopefully not fatal, if the user picks a suitable set
of PCRs for sealing data.

With regards,
Daniel
-- 
|: https://berrange.com      -o-    https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org         -o-            https://fstop138.berrange.com :|
|: https://entangle-photo.org    -o-    https://www.instagram.com/dberrange :|