[13.4-stable] Backport vTPM fixes#5796
Conversation
Update eve-api to include the latest changes that support dynamic PCRs Signed-off-by: Shahriyar Jalayeri <shahriyar@posteo.de>
This commit introduces the ability to dynamically update the PCR policy used for sealing the disk encryption key, allowing the controller to define which PCRs are used for sealing. Key changes: evetpm: Added functionality to persist and validate PCR policy configuration in policy-pcr.json, plus recovring policy in case of configuration corruption. vaultmgr: Updated key handling logic to detect policy changes from the controller, persist the new policy, and trigger a reseal of the disk encryption key. zedagent: Added extraction of PCR policy information from AttestStorageKeys protobuf messages to pass to vaultmgr. types: Introduced VaultKeyPolicyPCR struct and PolicyPcrFile constant to support policy propagation. tests: Added unit tests for policy digest computation and validation. Signed-off-by: Shahriyar Jalayeri <shahriyar@posteo.de> (cherry picked from commit c4982d6) Signed-off-by: Shahriyar Jalayeri <shahriyar@posteo.de>
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## 13.4-stable #5796 +/- ##
===============================================
+ Coverage 24.78% 30.33% +5.55%
===============================================
Files 8 8
Lines 1138 989 -149
===============================================
+ Hits 282 300 +18
+ Misses 788 611 -177
- Partials 68 78 +10 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
eriknordmark
left a comment
There was a problem hiding this comment.
pkg/vtpm diffs include
// FIX-ME : update this after pillar changes is merged!!!
Does that mean there is a follow-up backport PR needed once this is merged into 13.4-stable?
|
I have a fix for master, I want to include it in this backport PR, so keeping open for now. |
|
Does 13.4-stable also need the log rotation fix? |
Yes, I'll pull all the fixes same as 14.x PR. |
Description
Backport of #5398
PR dependencies
List all dependencies of this PR (when applicable, otherwise remove this
section).
How to test and validate this PR
Please describe how the changes in this PR can be validated or verified. For
example:
This will be used
The first is especially important, so, please make sure to provide as much
detail as possible.
If it's covered by an automated test, please mention it here.
Changelog notes
Text in this section will be used to generate the changelog entry for
release notes. The consumers of this are end users, not developers.
So, provide a clear and short description of what is changed in the PR from
the end user perspective. If it changes only tooling or some internal
implementation, put a note like "No user-facing changes" or "None".
PR Backports
For all current LTS branches, please state explicitly if this PR should be
backported or not. This section is used by our scripts to track the backports,
so, please, do not omit it.
Here is the list of current LTS branches (it should be always up to date):
For example, if this PR fixes a bug in a feature that was introduced in 14.5,
you can write:
Also, to the PRs that should be backported into any stable branch, please
add a label
stable.Checklist
For backport PRs (remove it if it's not a backport):
And the last but not least:
check them.
Please, check the boxes above after submitting the PR in interactive mode.