linux-security-module.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: James Bottomley <jejb@linux.ibm.com>
To: Brijesh Singh <brijesh.singh@amd.com>,
	Andi Kleen <ak@linux.intel.com>,
	"Dr. David Alan Gilbert" <dgilbert@redhat.com>
Cc: Dov Murik <dovmurik@linux.ibm.com>,
	linux-efi@vger.kernel.org,
	Tobin Feldman-Fitzthum <tobin@linux.ibm.com>,
	Tobin Feldman-Fitzthum <tobin@ibm.com>,
	Jim Cadden <jcadden@ibm.com>,
	Hubertus Franke <frankeh@us.ibm.com>,
	Mike Rapoport <rppt@linux.ibm.com>,
	Laszlo Ersek <lersek@redhat.com>,
	Ashish Kalra <ashish.kalra@amd.com>,
	Tom Lendacky <thomas.lendacky@amd.com>,
	Ard Biesheuvel <ardb@kernel.org>,
	James Morris <jmorris@namei.org>,
	"Serge E. Hallyn" <serge@hallyn.com>,
	linux-security-module@vger.kernel.org,
	linux-kernel@vger.kernel.org
Subject: Re: [RFC PATCH 0/3] Allow access to confidential computing secret area
Date: Fri, 21 May 2021 09:03:23 -0700	[thread overview]
Message-ID: <d6b991603d79cfbaf05c93f8b662860b865d861b.camel@linux.ibm.com> (raw)
In-Reply-To: <c316c49c-03db-22e3-0072-ebaf3c7f2ca2@amd.com>

On Fri, 2021-05-21 at 10:56 -0500, Brijesh Singh wrote:
[...]
> In case of the SEV-SNP and TDX, the guest OS participates during the
> attestation flow; the driver working on the behalf of userspace and
> does not have access to the secret, so it cannot populate the file
> with the secrets in it.

OK, so for a simple encrypted VM using root on luks, how in SNP does
the boot loader obtain the disk passphrase?

In the non SNP case, it's already upstream: OVMF finds the secret page
and converts it to an EFI config table, which is passed into grub. 
It's starting to sound like we'll need a new grub module for SNP which
will do an active attestation and receive the passphrase over some
channel secure against the cloud provider.  Could you give us an
example of how you think this flow will work?

Thanks,

James



  reply	other threads:[~2021-05-21 16:03 UTC|newest]

Thread overview: 15+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-05-13  6:26 [RFC PATCH 0/3] Allow access to confidential computing secret area Dov Murik
2021-05-13  6:26 ` [RFC PATCH 3/3] virt: Add sev_secret module to expose confidential computing secrets Dov Murik
2021-05-14 13:01 ` [RFC PATCH 0/3] Allow access to confidential computing secret area Brijesh Singh
2021-05-20 10:38   ` Dov Murik
2021-05-20 10:56   ` Dr. David Alan Gilbert
2021-05-20 22:02     ` Andi Kleen
2021-05-21 15:56       ` Brijesh Singh
2021-05-21 16:03         ` James Bottomley [this message]
2021-05-21 16:21           ` Brijesh Singh
2021-05-21 16:41         ` Andi Kleen
2021-05-24 12:08           ` Dr. David Alan Gilbert
2021-05-24 15:35             ` James Bottomley
2021-05-24 16:31             ` Andi Kleen
2021-05-24 17:12               ` James Bottomley
2021-06-08 19:48                 ` Dov Murik

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=d6b991603d79cfbaf05c93f8b662860b865d861b.camel@linux.ibm.com \
    --to=jejb@linux.ibm.com \
    --cc=ak@linux.intel.com \
    --cc=ardb@kernel.org \
    --cc=ashish.kalra@amd.com \
    --cc=brijesh.singh@amd.com \
    --cc=dgilbert@redhat.com \
    --cc=dovmurik@linux.ibm.com \
    --cc=frankeh@us.ibm.com \
    --cc=jcadden@ibm.com \
    --cc=jmorris@namei.org \
    --cc=lersek@redhat.com \
    --cc=linux-efi@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-security-module@vger.kernel.org \
    --cc=rppt@linux.ibm.com \
    --cc=serge@hallyn.com \
    --cc=thomas.lendacky@amd.com \
    --cc=tobin@ibm.com \
    --cc=tobin@linux.ibm.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).