Hi
On Thu, Sep 26, 2024 at 11:32 PM Stefan Berger <stefanb@xxxxxxxxxxxxx> wrote:
>
> Upcoming libtpms v0.10 and swtpm v0.10 will have TPM profile support that
> allows to restrict a TPM's provided set of crypto algorithms and commands
> and through which backwards compatibility and migration from newer versions
> of libtpms to older ones (up to libtpms v0.9) is supported. For the latter
> to work it is necessary that the user chooses the right ('null') profile.
>
> This series adds support for passing a profile choice to swtpm_setup by
> setting it in the domain XML using the <profile/> XML node. An optional
> attribute 'remove_disabled' can be set in this node and accepts two values:
>
> "check": test a few crypto algorithms (tdes, camellia, unpadded encryption,
> and others) for whether they are currently disabled due to FIPS
> mode on the host and remove these algorithms in the 'custom'
> profile if they are disabled;
Given that this option can expose a different vTPM to the guest, I
wonder if it should be in the libvirt XML.
So if no "remove_disabled" option is given, no check and removal is
performed? there should probably be a third option then. "none" ?
> "fips-host": do not test but remove all the possibly disabled crypto
> algorithms (from list above)
>
This one however feels safer to expose.
I'd suggest a simpler naming too: disable_crypto=none/fips ?
> Also extend the documentation but point the user to swtpm and libtpms
> documentation for further details.
>
> Follow Deniel's suggestions there's now a PR for swtpm_setup to support
> searching for profiles though a configurable local directory, distro
> directory and if no profile could be found there (with appended
> ".json" suffix) it will fall back to try to use a built-in profile by
> the provided name: https://github.com/stefanberger/swtpm/pull/918
>
> Stefan
>
> Stefan Berger (8):
> conf: Move TPM emulator parameters into own struct
> qemu: Pass virQEMUDriverConfig rather than some of its fields
> util: Add parsing support for swtpm_setup's cmdarg-profile capability
> conf: Define enum virDomainTPMProfileRemoveDisabled
> schema: Extend schema for TPM emulator profile node
> conf: Add support for profile parameter on TPM emulator in domain XML
> docs: Add documentation for the TPM backend profile node
> qemu: Extend swtpm_setup command line to set a profile by its name
>
> docs/formatdomain.rst | 30 ++++++++
> src/conf/domain_conf.c | 43 +++++++++++
> src/conf/domain_conf.h | 35 ++++++---
> src/conf/domain_validate.c | 7 ++
> src/conf/schemas/domaincommon.rng | 25 ++++++
> src/conf/virconftypes.h | 2 +
> src/qemu/qemu_tpm.c | 124 +++++++++++++++++-------------
> src/util/virtpm.c | 1 +
> src/util/virtpm.h | 1 +
> tests/testutilsqemu.c | 1 +
> 10 files changed, 203 insertions(+), 66 deletions(-)
>
> --
> 2.46.1
>
