Daniel P. Berrangé
4b1153cfcc
efi: don't pull kernel cmdline from SMBIOS in a confidential VM
...
In a confidential VM, the SMBIOS data is not trusted, as it is under the
control of the host OS/admin and not covered by attestation of the machine.
Fixes: https://github.com/systemd/systemd/issues/27604
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com >
2023-07-14 14:18:09 +01:00
Daniel P. Berrangé
b354a2cafc
efi: add helper API for detecting confidential virtualization
...
This helper is a simplified version of detect_confidential_virtualization()
that merely returns a boolean status flag reflecting whether we are believed
to be running inside a confidential VM.
This flag can be used for turning off features that are inappropriate to
use from a CVM, but must not be used for releasing sensitive data. The
latter must only be done in response to an attestation for the environment.
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com >
2023-07-14 14:18:09 +01:00
Daniel P. Berrangé
129b9e3f42
fundamental: share constants for confidential virt detection
...
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com >
2023-07-14 14:06:51 +01:00
Daniel P. Berrangé
6e2e83b487
udev: add 'conf-virt' constant for confidential virtualization tech
...
Related: https://github.com/systemd/systemd/issues/27604
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com >
2023-07-06 12:20:04 +01:00
Daniel P. Berrangé
0895124572
core: set SYSTEMD_CONFIDENTIAL_VIRTUALIZATION env for generators
...
This reports the confidential virtualization type that was detected
Related: https://github.com/systemd/systemd/issues/27604
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com >
2023-07-06 12:20:04 +01:00
Daniel P. Berrangé
024469ddb9
core: log detected confidential virtualization type
...
Related: https://github.com/systemd/systemd/issues/27604
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com >
2023-07-06 12:20:04 +01:00
Daniel P. Berrangé
1257274ad8
dbus: add 'ConfidentialVirtualization' property to manager object
...
This property reports whether the system is running inside a confidential
virtual machine.
Related: https://github.com/systemd/systemd/issues/27604
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com >
2023-07-06 12:20:04 +01:00
Daniel P. Berrangé
95d043b159
unit: add "cvm" option for ConditionSecurity
...
The "cvm" flag indicates whether the OS is running inside a confidential
virtual machine.
Related: https://github.com/systemd/systemd/issues/27604
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com >
2023-07-06 12:20:04 +01:00
Daniel P. Berrangé
f460fec915
detect-virt: add --list-cvm option
...
The --list-cvm option reports the known types of confidential virtualization
technology that can be detected.
Related: https://github.com/systemd/systemd/issues/27604
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com >
2023-07-06 12:20:04 +01:00
Daniel P. Berrangé
5e0c61f64d
detect-virt: add --cvm option
...
The --cvm option detects whether the OS is running inside a confidential
virtual machine.
Related: https://github.com/systemd/systemd/issues/27604
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com >
2023-07-06 12:20:04 +01:00
Daniel P. Berrangé
a577a61625
add APIs for detecting confidential virtualization
...
This code uses various CPUID checks to be able to identify
* AMD SEV
* AMD SEV-ES
* AMD SEV-SNP
* Intel TDX
On HyperV/Azure, it has special checks for detecting SEV-SNP
since the normal CPUID is blocked.
Related: https://github.com/systemd/systemd/issues/27604
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com >
2023-07-06 12:20:04 +01:00
Daniel Berrange
5588612e9e
virt: enable detecting QEMU (TCG) via CPUID ( #6399 )
...
QEMU >= 2.10 will include a CPUID leaf with value "TCGTCGTCGTCG"
on x86 when running with the TCG CPU emulator:
https://lists.gnu.org/archive/html/qemu-devel/2017-07/msg05231.html
Existing methods of detecting QEMU are left unchanged for sake of
backcompatibility.
Signed-off-by: Daniel P. Berrange <berrange@redhat.com >
2017-07-19 11:06:07 +02:00
Daniel P. Berrangé