xen/stubdom/grub/mini-os.h at 58db743e3beb295acf7bb3f45601e7eb7b0fa70e - xen - Xen Gitea: Git with a cup of tea

xen-project/xen

0 Fork 0

mirror of https://github.com/xen-project/xen.git synced 2026-10-28 02:01:24 +01:00

Files

T

Daniel De Graaf 331d4b0eb8 stubdom/grub: verify vTPM label if requested

This adds an optional argument --vtpm-label=<label> to the pv-grub
command line.  If specified, a vtpm device must be connected to the
pv-grub domain and the backend of this device must have the given XSM
label (which may start with a * to indicate a wildcard).  Verifying the
label of the vTPM before sending measurements prevents a disaggregated
control domain that has access to xenstore but not to the guest domains
from causing the measurements performed by pv-grub to be discarded,
allowing the forgery of arbitrary kernel measurements in the TPM.

Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
Cc: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
Acked-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
Acked-by: Ian Campbell <ian.campbell@citrix.com>

2014-04-23 11:58:15 +01:00

8 lines

192 B

C

Raw Blame History

 extern int blk_nb;
 extern struct blkfront_dev **blk_dev;
 extern struct netfront_dev *net_dev;
 extern struct kbdfront_dev *kbd_dev;
 extern struct fbfront_dev *fb_dev;
 extern char* vtpm_label;