b922d8ba2d
IBM SEL(Secure Execution for Linux) is supported for s390 KVM guests. SEL images used to start a confidential computing protected guest contain an encrypted boot image which encapsulates the kernel the initrd and the bootparams. The encrypted Image is provided by the KVM/hypervisor to the Embedded zFirmware of the system (the ultravisor device). The decryption keys are hardware based and each system has an individual keypool unique to that system. The root filesystem is LUKS encrypted with a random key produced by kiwi at build time and kept inside of the initrd which exists only inside of the encrypted boot image and the encrypted rootfs to allow kernel updates. The commit to support secure execution also comes with an integration test that provides profiled image builds to target SUSE's LinuxONE as well as IBM Cloud systems.
35 lines
1.3 KiB
XML
35 lines
1.3 KiB
XML
<?xml version="1.0" encoding="utf-8"?>
|
|
|
|
<image schemaversion="8.2" name="test-containers">
|
|
<description type="system">
|
|
<author>Some</author>
|
|
<contact>some@example.com</contact>
|
|
<specification>
|
|
Test containers section used in the buildservice
|
|
</specification>
|
|
</description>
|
|
<preferences>
|
|
<version>1.1.1</version>
|
|
<packagemanager>zypper</packagemanager>
|
|
<type image="oem" filesystem="xfs">
|
|
<bootloader name="zipl" timeout="10">
|
|
<securelinux hkd_sign_cert="some1-signing.crt" hkd_ca_cert="some-ca.crt">
|
|
<hkd_cert name="some1-host.crt"/>
|
|
<hkd_cert name="some2-host.crt"/>
|
|
<hkd_revocation_list name="some1-revocation.crl"/>
|
|
</securelinux>
|
|
<securelinux hkd_sign_cert="some2-signing.crt" hkd_ca_cert="some-ca.crt">
|
|
<hkd_cert name="some3-host.crt"/>
|
|
<hkd_revocation_list name="some2-revocation.crl"/>
|
|
</securelinux>
|
|
</bootloader>
|
|
</type>
|
|
</preferences>
|
|
<repository>
|
|
<source path="obs://some/repo/oss"/>
|
|
</repository>
|
|
<packages type="bootstrap">
|
|
<package name="filesystem"/>
|
|
</packages>
|
|
</image>
|