b922d8ba2d
IBM SEL(Secure Execution for Linux) is supported for s390 KVM guests. SEL images used to start a confidential computing protected guest contain an encrypted boot image which encapsulates the kernel the initrd and the bootparams. The encrypted Image is provided by the KVM/hypervisor to the Embedded zFirmware of the system (the ultravisor device). The decryption keys are hardware based and each system has an individual keypool unique to that system. The root filesystem is LUKS encrypted with a random key produced by kiwi at build time and kept inside of the initrd which exists only inside of the encrypted boot image and the encrypted rootfs to allow kernel updates. The commit to support secure execution also comes with an integration test that provides profiled image builds to target SUSE's LinuxONE as well as IBM Cloud systems.
80 lines
2.3 KiB
Python
80 lines
2.3 KiB
Python
# Copyright (c) 2024 SUSE Software Solutions Germany GmbH. All rights reserved.
|
|
#
|
|
# This file is part of kiwi.
|
|
#
|
|
# kiwi is free software: you can redistribute it and/or modify
|
|
# it under the terms of the GNU General Public License as published by
|
|
# the Free Software Foundation, either version 3 of the License, or
|
|
# (at your option) any later version.
|
|
#
|
|
# kiwi is distributed in the hope that it will be useful,
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
# GNU General Public License for more details.
|
|
#
|
|
# You should have received a copy of the GNU General Public License
|
|
# along with kiwi. If not, see <http://www.gnu.org/licenses/>
|
|
#
|
|
from string import Template
|
|
from textwrap import dedent
|
|
|
|
|
|
class BootLoaderTemplateZipl:
|
|
"""
|
|
**zipl configuraton file templates**
|
|
"""
|
|
def __init__(self):
|
|
self.cr = '\n'
|
|
|
|
self.main_conf = dedent('''
|
|
[defaultboot]
|
|
defaultauto
|
|
prompt=1
|
|
target=${bootpath}
|
|
${targetbase}
|
|
targettype=${targettype}
|
|
targetblocksize=${targetblocksize}
|
|
targetoffset=${targetoffset}
|
|
${targetgeometry}
|
|
timeout=${boot_timeout}
|
|
secure=auto
|
|
''').strip() + self.cr
|
|
|
|
self.entry_secure = dedent('''
|
|
title ${title}
|
|
options ${boot_options}
|
|
linux ${secure_image_file}
|
|
''').strip() + self.cr
|
|
|
|
self.entry_standard = dedent('''
|
|
title ${title}
|
|
options ${boot_options}
|
|
linux ${kernel_file}
|
|
initrd ${initrd_file}
|
|
''').strip() + self.cr
|
|
|
|
def get_loader_template(self) -> Template:
|
|
"""
|
|
Bootloader main configuration template
|
|
|
|
:return: instance of :class:`Template`
|
|
|
|
:rtype: Template
|
|
"""
|
|
template_data = self.main_conf
|
|
return Template(template_data)
|
|
|
|
def get_entry_template(self, secure: bool = False) -> Template:
|
|
"""
|
|
Bootloader entry configuration template
|
|
|
|
:return: instance of :class:`Template`
|
|
|
|
:rtype: Template
|
|
"""
|
|
if secure:
|
|
template_data = self.entry_secure
|
|
else:
|
|
template_data = self.entry_standard
|
|
return Template(template_data)
|