Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add CLI argument for SNP context directory #5686

Merged
merged 9 commits into from
Sep 26, 2023
2 changes: 1 addition & 1 deletion .snpcc_canary
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
___ ___ ___
(. =) Y (0 0) (* *) Y
O \ . | /
/-xXx--//-----x=x--/-xXx--/---x---->
/-xXx--//-----x=x--/-xXx--/---x---->>
2 changes: 1 addition & 1 deletion CHANGELOG.md
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
- Updated `nghttp2` from `1.51.0` to `1.55.1`.
- Converted SNP attestation UVM endorsements from integer to arbitrary string.
- Updated Intel SGX PSW from 2.17 to 2.20 (#5616)
- Path to the enclave file should now be passed as `--enclave-file` CLI argument to `cchost`, rather than `enclave.file` entry within configuration file. This is to ensure the path to the application file is attested on Confidential Containers/SNP, even if the configuration itself is provided from un-attested storage. The configuration entry is deprecated, and will be removed in a future release.
- Path to the enclave file should now be passed as `--enclave-file` CLI argument to `cchost`, rather than `enclave.file` entry within configuration file. SNP security context directory environment variable should now be passed as `--snp-security-context-dir-var` CLI argument to `cchost`, rather than `attestation.environment.security_context_directory` entry within configuration file. This is to ensure that these values are attested on Confidential Containers/SNP, even if the configuration itself is provided from un-attested storage. The configuration entries are deprecated, and will be removed in a future release.
achamayou marked this conversation as resolved.
Show resolved Hide resolved
- Secret sharing used for ledger recovery now relies on a much simpler implementation that requires no external dependencies. Note that while the code still accepts shares generated by the old code for now, it only generates shares with the new implementation. As a result, a DR attempt that would downgrade the code to a version that pre-dates this change, after having previously picked it up, would not succeed if a reshare had already taken place (#5655).

## [5.0.0-dev1]
Expand Down
12 changes: 6 additions & 6 deletions doc/host_config_schema/cchost_config.json
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@
"properties": {
"file": {
"type": "string",
"description": "Path to enclave application"
"description": "DEPRECATED: Replaced by --enclave-file CLI argument. Path to enclave application"
},
"platform": {
"type": "string",
Expand All @@ -25,7 +25,7 @@
}
},
"description": "This section includes configuration for the enclave application launched by this node",
"required": [],
"required": ["platform", "type"],
"additionalProperties": false
},
"network": {
Expand Down Expand Up @@ -449,11 +449,11 @@
"properties": {
"security_context_directory": {
"type": ["string", "null"],
"description": "Name of environment variable (e.g. ``UVM_SECURITY_CONTEXT_DIR``) specifying the directory containing the security context files (i.e. ``host-amd-cert-base64``, ``security-policy-base64`` and ``reference-info-base64``)."
"description": "DEPRECATED: Replaced by --snp-security-context-dir-var CLI argument. Name of environment variable (e.g. ``UVM_SECURITY_CONTEXT_DIR``) specifying the directory containing the security context files (i.e. ``host-amd-cert-base64``, ``security-policy-base64`` and ``reference-info-base64``)."
}
},
"description": "Environment variables required to provide best auditability and serviceability for Azure Container Instance deployments (SEV-SNP only)",
"required": ["security_context_directory"],
"required": [],
"additionalProperties": false
},
"snp_endorsements_servers": {
Expand All @@ -475,7 +475,7 @@
"required": ["url"],
"additionalProperties": false
},
"description": "List of servers used to retrieve attestation report endorsement certificates (SEV-SNP only). The first server in the list is always used and other servers are only specified as fallback. If set, endorsements from ``environment.security_context_directory`` are ignored"
"description": "List of servers used to retrieve attestation report endorsement certificates (SEV-SNP only). The first server in the list is always used and other servers are only specified as fallback. If set, endorsements from ``--snp-security-context-dir-var`` are ignored"
achamayou marked this conversation as resolved.
Show resolved Hide resolved
}
},
"description": "This section includes configuration for the attestation for AMD SEV-SNP platform (ignored for SGX)",
Expand Down Expand Up @@ -680,6 +680,6 @@
"minimum": 0
}
},
"required": ["network", "command"],
"required": ["enclave", "network", "command"],
"additionalProperties": false
}
2 changes: 1 addition & 1 deletion doc/operations/platforms/snp.rst
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@ Azure Confidential ACI provides a security context directory containing the foll
- ``security-policy-base64``: The security policy [#security_policy]_ describing the state and transitions allowed for the container (Base64 encoded). The SHA256 hash of the decoded value should match the attestation report ``host_data``. This value is stored in the :ref:`audit/builtin_maps:``nodes.snp.host_data``` table.
- ``reference-info-base64``: The COSE Sign1 document containing the measurement [#measurement]_ of the utility VM (UVM) used to launch the container (Base64 encoded). The measurement contained in the document payload should match the report ``measurement``. If set, the value is stored in the :ref:`audit/builtin_maps:``nodes.snp.uvm_endorsements``` table and new nodes must present measurement endorsements from the same issuer (`did:x509`) to be trusted.

The location of the security context directory is passed to the container's startup command as the ``UVM_SECURITY_CONTEXT_DIR`` environment variable. The name of this environment variable should be specified as the value of the ``security_context_directory`` in the :ref:`operations/configuration:``environment``` configuration section.
The location of the security context directory is passed to the container's startup command as the ``UVM_SECURITY_CONTEXT_DIR`` environment variable. The name of an alternative environment variable may be specified as the value of the ``--snp-security-context-dir-var`` CLI argument, if an alternative trust root is needed.

.. tip:: See :ccf_repo:`samples/config/start_config_aci_sev_snp.json` for a sample node configuration for ACI deployments.

Expand Down
7 changes: 3 additions & 4 deletions src/host/configuration.h
Original file line number Diff line number Diff line change
Expand Up @@ -168,8 +168,8 @@ namespace host
};

DECLARE_JSON_TYPE_WITH_OPTIONAL_FIELDS(CCHostConfig::Enclave);
DECLARE_JSON_REQUIRED_FIELDS(CCHostConfig::Enclave);
DECLARE_JSON_OPTIONAL_FIELDS(CCHostConfig::Enclave, file, type, platform);
DECLARE_JSON_REQUIRED_FIELDS(CCHostConfig::Enclave, type, platform);
DECLARE_JSON_OPTIONAL_FIELDS(CCHostConfig::Enclave, file);

DECLARE_JSON_TYPE_WITH_OPTIONAL_FIELDS(CCHostConfig::OutputFiles);
DECLARE_JSON_REQUIRED_FIELDS(CCHostConfig::OutputFiles);
Expand Down Expand Up @@ -225,10 +225,9 @@ namespace host
CCHostConfig::Command, service_certificate_file, start, join, recover);

DECLARE_JSON_TYPE_WITH_BASE_AND_OPTIONAL_FIELDS(CCHostConfig, CCFConfig);
DECLARE_JSON_REQUIRED_FIELDS(CCHostConfig, command);
DECLARE_JSON_REQUIRED_FIELDS(CCHostConfig, enclave, command);
DECLARE_JSON_OPTIONAL_FIELDS(
CCHostConfig,
enclave,
tick_interval,
slow_io_logging_threshold,
node_client_interface,
Expand Down
23 changes: 21 additions & 2 deletions src/host/main.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -124,6 +124,15 @@ int main(int argc, char** argv)
enclave_file_path,
"Path to enclave application (security critical)");

std::string snp_security_context_dir_var = "UVM_SECURITY_CONTEXT_DIR";
app
.add_option(
"--snp-security-context-dir-var",
snp_security_context_dir_var,
"Name of environment variable specifying the directory containing the "
"SNP UVM security context files (security critical)")
->capture_default_str();

try
{
app.parse(argc, argv);
Expand Down Expand Up @@ -502,10 +511,20 @@ int main(int argc, char** argv)
startup_config.snapshot_tx_interval = config.snapshots.tx_count;

if (config.attestation.environment.security_context_directory.has_value())
{
LOG_FAIL_FMT(
"DEPRECATED: security_context_dir was specified in config file! This "
"should be removed from the config, and passed directly to the CLI. "
"Note that the CLI provides a default value, which may be sufficient");

snp_security_context_dir_var =
config.attestation.environment.security_context_directory.value();
}

if (config.enclave.platform == host::EnclavePlatform::SNP)
{
auto dir = read_required_environment_variable(
config.attestation.environment.security_context_directory.value(),
"security context directory");
snp_security_context_dir_var, "security context directory");

constexpr auto security_policy_filename = "security-policy-base64";
startup_config.attestation.environment.security_policy =
Expand Down
6 changes: 1 addition & 5 deletions tests/config.jinja
Original file line number Diff line number Diff line change
Expand Up @@ -20,11 +20,7 @@
"node_data_json_file": {{ node_data_json_file|tojson }},
"attestation":
{
"snp_endorsements_servers": {{ snp_endorsements_servers|tojson }},
"environment":
{
"security_context_directory": {{ snp_security_context_directory_envvar|tojson }}
}
"snp_endorsements_servers": {{ snp_endorsements_servers|tojson }}
},
"service_data_json_file": {{ service_data_json_file|tojson }},
"command": {
Expand Down
7 changes: 6 additions & 1 deletion tests/infra/remote.py
Original file line number Diff line number Diff line change
Expand Up @@ -789,7 +789,7 @@ def __init__(
service_cert_file=service_cert_file,
snp_endorsements_servers=snp_endorsements_servers_list,
node_pid_file=node_pid_file,
snp_security_context_directory_envvar=snp_security_context_directory_envvar,
snp_security_context_directory_envvar=snp_security_context_directory_envvar, # Ignored by current jinja, but passed for LTS compat
ignore_first_sigterm=ignore_first_sigterm,
node_address=remote_class.get_node_address(node_address),
follow_redirect=follow_redirect,
Expand Down Expand Up @@ -847,6 +847,11 @@ def __init__(
"--enclave-file",
self.enclave_file,
]
if snp_security_context_directory_envvar is not None:
cmd += [
"--snp-security-context-dir-var",
snp_security_context_directory_envvar,
]

if start_type == StartType.start:
members_info = kwargs.get("members_info")
Expand Down