I've been working on wrapping various SEV kernel APIs for userspace consumption. There does not appear to be any privilege separation for these commands: you can run them all or none of them. This is less than ideal because it means that a compromise of the code which launches VMs could make permanent changes to the SEV certificate chain. These commands are required to attest the VM environment: SEV_PDH_CERT_EXPORT SEV_PLATFORM_STATUS SEV_GET_ID These commands manage the SEV certificate chain: SEV_PEK_CERT_IMPORT SEV_FACTORY_RESET SEV_PEK_GEN SEV_PEK_CSR SEV_PDH_GEN I would expect the first group of commands to be able to be called by whatever actor launches VMs. The latter group of commands should be able to be called by whatever actor manages the SEV environment. I don't have strong opinions on how this privilege separation should happen. It might be sufficient to distinguish these based on the mode of the open() call. This could then be managed with filesystem permissions. But I'm open to other ideas.
