mirror of
https://github.com/systemd/systemd.git
synced 2026-08-10 17:14:31 +00:00
f3818538fa
A report signing backend that returns a confidential-computing attestation report obtained via configfs-tsm. Implements io.systemd.Report.Signer.Sign(): embeds the digest as the report's inblob and returns the outblob (plus provider and any aux/manifest blobs). Wired up as the "tsm" mechanism with a socket-activated service. Signed-off-by: Paul Meyer <katexochen0@gmail.com>
74 lines
3.7 KiB
XML
74 lines
3.7 KiB
XML
<?xml version="1.0"?> <!--*-nxml-*-->
|
|
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
|
|
"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd">
|
|
<!-- SPDX-License-Identifier: LGPL-2.1-or-later -->
|
|
|
|
<refentry id="systemd-report-sign-tsm_.service"
|
|
xmlns:xi="http://www.w3.org/2001/XInclude">
|
|
|
|
<refentryinfo>
|
|
<title>systemd-report-sign-tsm@.service</title>
|
|
<productname>systemd</productname>
|
|
</refentryinfo>
|
|
|
|
<refmeta>
|
|
<refentrytitle>systemd-report-sign-tsm@.service</refentrytitle>
|
|
<manvolnum>8</manvolnum>
|
|
</refmeta>
|
|
|
|
<refnamediv>
|
|
<refname>systemd-report-sign-tsm@.service</refname>
|
|
<refname>systemd-report-sign-tsm.socket</refname>
|
|
<refname>systemd-report-sign-tsm</refname>
|
|
<refpurpose>Sign system reports with a confidential-computing attestation report</refpurpose>
|
|
</refnamediv>
|
|
|
|
<refsynopsisdiv>
|
|
<para><filename>systemd-report-sign-tsm@.service</filename></para>
|
|
<para><filename>systemd-report-sign-tsm.socket</filename></para>
|
|
<para><filename>/usr/lib/systemd/systemd-report-sign-tsm</filename></para>
|
|
</refsynopsisdiv>
|
|
|
|
<refsect1>
|
|
<title>Description</title>
|
|
|
|
<para><command>systemd-report-sign-tsm@.service</command> is a system service that signs system reports
|
|
generated by
|
|
<citerefentry><refentrytitle>systemd-report</refentrytitle><manvolnum>1</manvolnum></citerefentry>. It is
|
|
a signing backend for the <option>--sign=</option> logic of that tool: it implements the
|
|
<function>io.systemd.Report.Signer.Sign()</function> Varlink method and is reached via a socket linked into
|
|
the <filename>/run/systemd/report.sign/</filename> directory, named <filename>tsm</filename>.</para>
|
|
|
|
<para>The service is socket-activated (one instance per connection) via
|
|
<filename>systemd-report-sign-tsm.socket</filename>. Rather than signing with a local key, it obtains a
|
|
hardware-backed attestation report from the platform's Trusted Security Module (TSM) through the kernel's
|
|
configfs-TSM interface at <filename>/sys/kernel/config/tsm/report/</filename>. The digest passed to it is
|
|
embedded into the report as its run-time provided data (<literal>inblob</literal>), cryptographically
|
|
binding the attestation report to the system report being signed.</para>
|
|
|
|
<para>The returned signature carries the binary attestation report (the <literal>outblob</literal>), the
|
|
name of the TSM provider that generated it (for example <literal>sev_guest</literal> for AMD SEV-SNP or
|
|
<literal>tdx_guest</literal> for Intel TDX), and, where the provider supplies them, supplemental
|
|
certificate (<literal>auxblob</literal>) and manifest (<literal>manifestblob</literal>) data. A verifier
|
|
selects the appropriate validation logic based on the provider field.</para>
|
|
|
|
<para>This backend is only functional inside a confidential virtual machine whose kernel exposes the
|
|
configfs-TSM interface (such as AMD SEV-SNP or Intel TDX guests). On systems where the interface is
|
|
unavailable the signing operation is reported as unsupported and the mechanism is skipped. The service
|
|
keeps no persistent state.</para>
|
|
</refsect1>
|
|
|
|
<!-- Note: we do not document the command line switches here. The systemd-report-sign-tsm binary itself
|
|
should not be invoked by users, but only as a service. Use systemd-report(1) to generate signed
|
|
reports. -->
|
|
|
|
<refsect1>
|
|
<title>See Also</title>
|
|
<para><simplelist type="inline">
|
|
<member><citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry></member>
|
|
<member><citerefentry><refentrytitle>systemd-report</refentrytitle><manvolnum>1</manvolnum></citerefentry></member>
|
|
</simplelist></para>
|
|
</refsect1>
|
|
|
|
</refentry>
|