Be much stricter when processing Attested COS State

[josephlr]

Currently in getVerifiedCosState we do two things that are bad from a security perspective:

1. We do not require the CEL events to use PCR 13
2. We skip events that we do not understand (record.Content.Type != cel.CosEventType)

(1) is an issue because after a container launchers, we assume that a breakout is possible. So a malicious user can:

• Breakout of a container
• Extend fake events to PCR 14
• Create their own fake CEL eventlog matching the PCR 14 extensions
• Verify an attestation using PCR 14 and this fake CEL eventlog
• Get fake container state to appear in the MachineState.

(2) is an issue because the record.Content.Type hasn't (yet) been verified in the loop. This means that a malicious user can:

• Breakout of a container
• Modify the CEL log to change the content type
• Our processing will then skip this valid event
• This causes data to be omitted from the MachineState

This change:

• Adds the concept of a "launch separator" event that is measured right before a container is launched
• Only creates AttestedCosState from PCR 13 data
• Fails processing if we encounter any CEL events we don't understand (COS or otherwise)
• Will not accept any AttestedCosState after a separator event is seen.
• Will not accept duplicate ImageRefType, ImageDigestType, or ImageIDType
  • We can't do this for other events, as having multiple events for the other types isn't an error.
  • For example: multiple EnvVarType events are present if multiple environment variables are overridden.

This fixes the worst of the issues described above. Note, this doesn't change the client-side launcher at all. #247 will change the launcher code to actually measure in the LaunchSeparator event. Until then, a container breakout can cause some of the AttestedCosState to be wrong, but it cannot modify image_reference, image_digest, or image_id.

I also had to modify our tests somewhat, including adding test.SkipForRealTPM(t) as we can only run some of our tests against PCR13, which cannot be reset on a Real TPM.

Signed-off-by: Joe Richey joerichey@google.com

[jessieqliu]

LGTM, some minor changes