Adding memory monitor measurement

cel/cos_tlv.go

@@ -31,6 +31,7 @@ const (
 	OverrideEnvType
 	// EventContent is empty on success, or contains an error message on failure.
 	LaunchSeparatorType
+	MemoryMonitorType
 )
 
 // CosTlv is a specific event type created for the COS (Google Container-Optimized OS),

launcher/container_runner.go

@@ -281,6 +281,11 @@ func appendTokenMounts(mounts []specs.Mount) []specs.Mount {
 	return append(mounts, m)
 }
 
+var launchEventSeparator = cel.CosTlv{
+	EventType:    cel.LaunchSeparatorType,
+	EventContent: nil, // Success
+}
+
 // measureContainerClaims will measure various container claims into the COS
 // eventlog in the AttestationAgent.
 func (r *ContainerRunner) measureContainerClaims(ctx context.Context) error {
@@ -334,11 +339,20 @@ func (r *ContainerRunner) measureContainerClaims(ctx context.Context) error {
 		}
 	}
 
-	separator := cel.CosTlv{
-		EventType:    cel.LaunchSeparatorType,
-		EventContent: nil, // Success
+	return r.attestAgent.MeasureEvent(launchEventSeparator)
+}
+
+// measureHealthMonitoringClaims will measure health monitoring related claims into the COS eventlog in the AttestationAgent.
+// For now only memory monitoring will be measured into the COS eventlog, but more measurements (cpu, disk, network, etc.) will be added in the future.
+func (r *ContainerRunner) measureHealthMonitoringClaims() error {
+	var memoryMonitorBit uint8
+	if r.launchSpec.MemoryMonitoringEnabled {
+		memoryMonitorBit = 1
 	}
-	return r.attestAgent.MeasureEvent(separator)
+	if err := r.attestAgent.MeasureEvent(cel.CosTlv{EventType: cel.MemoryMonitorType, EventContent: []byte{memoryMonitorBit}}); err != nil {
+		return err
+	}
+	return r.attestAgent.MeasureEvent(launchEventSeparator)
 }
 
 // Retrieves the default OIDC token from the attestation service, and returns how long
@@ -528,6 +542,10 @@ func (r *ContainerRunner) Run(ctx context.Context) error {
 		} else {
 			r.logger.Println("MemoryMonitoring is disabled by the VM operator")
 		}
+
+		if err := r.measureHealthMonitoringClaims(); err != nil {
+			return fmt.Errorf("failed to measure health monitoring claims: %v", err)
+		}
 	}
 
 	var streamOpt cio.Opt

proto/attest.proto

@@ -186,10 +186,16 @@ message SemanticVersion {
   uint32 patch = 3;
 }
 
+message HealthMonitoringState {
+  // Whether memory monitoring is enabled.
+  bool memory_enabled = 1;
+}
+
 message AttestedCosState {
   ContainerState container = 1;
   SemanticVersion cos_version = 2;
   SemanticVersion launcher_version = 3;
+  HealthMonitoringState health_monitoring = 4;
 }
 
 message EfiApp {