Skip to content

Commit 231c3db

Browse files
schaefischaefi
authored
Merge pull request #2528 from OSInside/confidental_compute_s390
Confidential compute s390
2 parents 8ab85d3 + 43cd86d commit 231c3db

File tree

23 files changed

+1304
-78
lines changed

23 files changed

+1304
-78
lines changed

‎build-tests/s390/tumbleweed/test-image-MicroOS/appliance.kiwi‎

Lines changed: 231 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,231 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<!-- OBS-Profiles: @BUILD_FLAVOR@ -->
3+
<image schemaversion="7.5" name="kiwi-test-image-MicroOS">
4+
<description type="system">
5+
<author>Marcus Schäfer</author>
6+
<contact>[email protected]</contact>
7+
<specification>MicroOS disk test build for IBM Secure Execution</specification>
8+
</description>
9+
<profiles>
10+
<profile name="SUSE-Infra" description="MicroOS IBM SEL image LinuxONE_III@SUSE"/>
11+
<profile name="IBM-Cloud-Secure-Execution" description="MicroOS IBM SEL image LinuxONE@IBM-Cloud-VPC-Region-eu-de(z16)/Region-eu-gb(z15)"/>
12+
<profile name="IBM-Cloud-Standard" description="MicroOS IBM Cloud image"/>
13+
</profiles>
14+
<preferences>
15+
<version>16.0.0</version>
16+
<packagemanager>zypper</packagemanager>
17+
<bootloader-theme>openSUSE</bootloader-theme>
18+
<rpm-excludedocs>true</rpm-excludedocs>
19+
<locale>en_US</locale>
20+
</preferences>
21+
<preferences profiles="IBM-Cloud-Standard">
22+
<type
23+
image="oem"
24+
luks="random"
25+
luks_pbkdf="pbkdf2"
26+
luks_version="luks2"
27+
filesystem="btrfs"
28+
kernelcmdline="systemd.show_status=yes console=ttyS0,115200 console=tty0 net.ifnames=0 \$ignition_firstboot ignition.platform.id=qemu rd.debug"
29+
devicepersistency="by-uuid"
30+
btrfs_root_is_snapshot="true"
31+
btrfs_root_is_readonly_snapshot="false"
32+
btrfs_root_is_subvolume="true"
33+
btrfs_quota_groups="true"
34+
bootpartition="true"
35+
bootfilesystem="ext3"
36+
format="qcow2"
37+
>
38+
<luksformat>
39+
<option name="--cipher" value="aes-xts-plain64"/>
40+
<option name="--key-size" value="256"/>
41+
</luksformat>
42+
<oemconfig>
43+
<oem-unattended>true</oem-unattended>
44+
<oem-resize>true</oem-resize>
45+
</oemconfig>
46+
<bootloader name="zipl" timeout="10"/>
47+
<systemdisk>
48+
<volume name="home"/>
49+
<volume name="root"/>
50+
<volume name="opt"/>
51+
<volume name="srv"/>
52+
<volume name="boot/writable"/>
53+
<volume name="usr/local"/>
54+
<volume name="var" copy_on_write="false"/>
55+
</systemdisk>
56+
<size unit="G">2</size>
57+
</type>
58+
</preferences>
59+
<preferences profiles="IBM-Cloud-Secure-Execution">
60+
<type
61+
image="oem"
62+
luks="random"
63+
luks_pbkdf="pbkdf2"
64+
luks_version="luks2"
65+
filesystem="btrfs"
66+
kernelcmdline="systemd.show_status=yes console=ttyS0,115200 console=tty0 net.ifnames=0 \$ignition_firstboot ignition.platform.id=qemu swiotlb=262144 rd.debug"
67+
devicepersistency="by-uuid"
68+
btrfs_root_is_snapshot="true"
69+
btrfs_root_is_readonly_snapshot="false"
70+
btrfs_root_is_subvolume="true"
71+
btrfs_quota_groups="true"
72+
bootpartition="true"
73+
bootfilesystem="ext3"
74+
format="qcow2"
75+
>
76+
<luksformat>
77+
<option name="--cipher" value="aes-xts-plain64"/>
78+
<option name="--key-size" value="256"/>
79+
</luksformat>
80+
<oemconfig>
81+
<oem-unattended>true</oem-unattended>
82+
<oem-resize>true</oem-resize>
83+
</oemconfig>
84+
<bootloader name="zipl" timeout="10">
85+
<!-- LinuxONE@IBM-Cloud-VPC-Region-eu-de(z16) -->
86+
<securelinux hkd_sign_cert="/var/lib/se-certs/ibm-z-host-key-signing-gen2.crt" hkd_ca_cert="/var/lib/se-certs/DigiCertCA.crt">
87+
<hkd_cert name="/var/lib/se-certs/HKD-3932-02967D8.crt"/>
88+
<hkd_cert name="/var/lib/se-certs/HKD-3932-02967F8.crt"/>
89+
<hkd_cert name="/var/lib/se-certs/HKD-3932-0296878.crt"/>
90+
<hkd_revocation_list name="/var/lib/se-certs/ibm-z-host-key-gen2.crl"/>
91+
<hkd_revocation_list name="/var/lib/se-certs/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl"/>
92+
<hkd_revocation_list name="/var/lib/se-certs/DigiCertTrustedRootG4.crl"/>
93+
</securelinux>
94+
<!-- LinuxONE@IBM-Cloud-VPC-Region-eu-gb(z15) -->
95+
<securelinux hkd_sign_cert="/var/lib/se-certs/ibm-z-host-key-signing.crt" hkd_ca_cert="/var/lib/se-certs/DigiCertCA.crt">
96+
<hkd_cert name="/var/lib/se-certs/HKD-8562-024B858.crt"/>
97+
<hkd_cert name="/var/lib/se-certs/HKD-8562-024B868.crt"/>
98+
<hkd_cert name="/var/lib/se-certs/HKD-8562-024B878.crt"/>
99+
<hkd_revocation_list name="/var/lib/se-certs/ibm-z-host-key.crl"/>
100+
<hkd_revocation_list name="/var/lib/se-certs/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl"/>
101+
<hkd_revocation_list name="/var/lib/se-certs/DigiCertTrustedRootG4.crl"/>
102+
</securelinux>
103+
</bootloader>
104+
<systemdisk>
105+
<volume name="home"/>
106+
<volume name="root"/>
107+
<volume name="opt"/>
108+
<volume name="srv"/>
109+
<volume name="boot/writable"/>
110+
<volume name="usr/local"/>
111+
<volume name="var" copy_on_write="false"/>
112+
</systemdisk>
113+
<size unit="G">2</size>
114+
</type>
115+
</preferences>
116+
<preferences profiles="SUSE-Infra">
117+
<type
118+
image="oem"
119+
luks="random"
120+
luks_pbkdf="pbkdf2"
121+
luks_version="luks2"
122+
filesystem="btrfs"
123+
kernelcmdline="systemd.show_status=yes console=ttyS0,115200 console=tty0 net.ifnames=0 \$ignition_firstboot ignition.platform.id=qemu swiotlb=262144 rd.debug"
124+
devicepersistency="by-uuid"
125+
btrfs_root_is_snapshot="true"
126+
btrfs_root_is_readonly_snapshot="false"
127+
btrfs_root_is_subvolume="true"
128+
btrfs_quota_groups="true"
129+
bootpartition="true"
130+
bootfilesystem="ext3"
131+
format="qcow2"
132+
>
133+
<luksformat>
134+
<option name="--cipher" value="aes-xts-plain64"/>
135+
<option name="--key-size" value="256"/>
136+
</luksformat>
137+
<oemconfig>
138+
<oem-unattended>true</oem-unattended>
139+
<oem-resize>true</oem-resize>
140+
</oemconfig>
141+
<bootloader name="zipl" timeout="10">
142+
<securelinux hkd_sign_cert="/var/lib/se-certs/ibm-z-host-key-signing.crt" hkd_ca_cert="/var/lib/se-certs/DigiCertCA.crt">
143+
<!-- LinuxONE_III@SUSE -->
144+
<hkd_cert name="/var/lib/se-certs/HKD-8561-02688E8.crt.20241112"/>
145+
<hkd_revocation_list name="/var/lib/se-certs/ibm-z-host-key.crl"/>
146+
<hkd_revocation_list name="/var/lib/se-certs/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl"/>
147+
<hkd_revocation_list name="/var/lib/se-certs/DigiCertTrustedRootG4.crl"/>
148+
</securelinux>
149+
</bootloader>
150+
<systemdisk>
151+
<volume name="home"/>
152+
<volume name="root"/>
153+
<volume name="opt"/>
154+
<volume name="srv"/>
155+
<volume name="boot/writable"/>
156+
<volume name="usr/local"/>
157+
<volume name="var" copy_on_write="false"/>
158+
</systemdisk>
159+
<size unit="G">2</size>
160+
</type>
161+
</preferences>
162+
<users>
163+
<user password="$1$wYJUgpM5$RXMMeASDc035eX.NbYWFl0" home="/root" name="root" groups="root"/>
164+
</users>
165+
<repository type="rpm-md">
166+
<source path="obsrepositories:/"/>
167+
</repository>
168+
<packages type="image" profiles="IBM-Cloud-Secure-Execution">
169+
<package name="ibm-se-certificates"/>
170+
<package name="ibm-se-revocation-lists"/>
171+
<package name="cloud-se-host-certificates"/>
172+
<package name="cloud-init"/>
173+
<package name="cloud-init-config-suse"/>
174+
<package name="systemd-network"/>
175+
</packages>
176+
<packages type="image" profiles="IBM-Cloud-Standard">
177+
<package name="cloud-init"/>
178+
<package name="cloud-init-config-suse"/>
179+
<package name="systemd-network"/>
180+
</packages>
181+
<packages type="image" profiles="SUSE-Infra">
182+
<package name="ibm-se-certificates"/>
183+
<package name="ibm-se-revocation-lists"/>
184+
<package name="suse-se-host-certificates"/>
185+
<package name="systemd-network"/>
186+
</packages>
187+
<packages type="image">
188+
<package name="patterns-base-bootloader"/>
189+
<package name="kernel-default"/>
190+
<package name="ignition-dracut"/>
191+
<package name="combustion"/>
192+
<package name="btrfsmaintenance"/>
193+
<package name="btrfsprogs"/>
194+
<package name="microos-tools"/>
195+
<package name="sudo"/>
196+
<package name="s390-tools"/>
197+
<package name="dracut-kiwi-oem-repart"/>
198+
<package name="shadow"/>
199+
<package name="snapper"/>
200+
<package name="snapper-zypp-plugin"/>
201+
<package name="firewalld"/>
202+
<package name="microos-tools"/>
203+
<package name="health-checker-plugins-MicroOS"/>
204+
<package name="squashfs"/>
205+
<package name="openSUSE-repos-Tumbleweed"/>
206+
<package name="openssh-server"/>
207+
<package name="openssh"/>
208+
<package name="iproute2"/>
209+
<package name="less"/>
210+
<package name="curl"/>
211+
<package name="cryptsetup"/>
212+
<package name="procps"/>
213+
</packages>
214+
<packages type="bootstrap">
215+
<package name="gawk"/>
216+
<package name="grep"/>
217+
<package name="gzip"/>
218+
<package name="udev"/>
219+
<package name="xz"/>
220+
<package name="shadow"/>
221+
<package name="filesystem"/>
222+
<package name="coreutils"/>
223+
<package name="openssl"/>
224+
<package name="glibc-locale-base"/>
225+
<package name="ca-certificates"/>
226+
<package name="ca-certificates-mozilla"/>
227+
<package name="MicroOS-release-dvd"/>
228+
<package name="systemd-presets-branding-MicroOS"/>
229+
<package name="diffutils"/>
230+
</packages>
231+
</image>

‎build-tests/s390/tumbleweed/test-image-MicroOS/config.sh‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
#!/bin/bash
2+
# shellcheck disable=SC1091
3+
test -f /.kconfig && . /.kconfig
4+
set -euxo pipefail
5+
6+
declare kiwi_iname=${kiwi_iname}
7+
declare kiwi_profiles=${kiwi_profiles}
8+
9+
echo "Configure image: [${kiwi_iname}]-[${kiwi_profiles}]..."
10+
11+
#======================================
12+
# Setup Core Services
13+
#--------------------------------------
14+
systemctl enable sshd.service
15+
16+
#======================================
17+
# Setup Cloud Services
18+
#--------------------------------------
19+
for profile in ${kiwi_profiles//,/ }; do
20+
if [ "${profile}" = "IBM-Cloud-Standard" ] || [ "${profile}" = "IBM-Cloud-Secure-Execution" ]; then
21+
for service in \
22+
cloud-init-local.service \
23+
cloud-init.service \
24+
cloud-config.service \
25+
cloud-final.service \
26+
systemd-networkd \
27+
systemd-resolved
28+
do
29+
systemctl enable "${service}"
30+
done
31+
fi
32+
if [ "${profile}" = "SUSE-Infra" ]; then
33+
for service in \
34+
systemd-networkd \
35+
systemd-resolved
36+
do
37+
systemctl enable "${service}"
38+
done
39+
fi
40+
done
41+
42+
#=====================================
43+
# Configure snapper
44+
#-------------------------------------
45+
if [ "${kiwi_btrfs_root_is_snapshot-false}" = 'true' ]; then
46+
echo "creating initial snapper config ..."
47+
cp /usr/share/snapper/config-templates/default /etc/snapper/configs/root
48+
baseUpdateSysConfig /etc/sysconfig/snapper SNAPPER_CONFIGS root
49+
# Adjust parameters
50+
sed -i'' 's/^TIMELINE_CREATE=.*$/TIMELINE_CREATE="no"/g' \
51+
/etc/snapper/configs/root
52+
sed -i'' 's/^NUMBER_LIMIT=.*$/NUMBER_LIMIT="2-10"/g' \
53+
/etc/snapper/configs/root
54+
sed -i'' 's/^NUMBER_LIMIT_IMPORTANT=.*$/NUMBER_LIMIT_IMPORTANT="4-10"/g' \
55+
/etc/snapper/configs/root
56+
fi
57+
58+
for profile in ${kiwi_profiles//,/ }; do
59+
if [ "${profile}" = "IBM-Cloud-Standard" ]; then
60+
# For image tests with an extra boot partition the
61+
# kernel must not be a symlink to another area of
62+
# the filesystem. Latest changes on SUSE changed the
63+
# layout of the kernel which breaks every image with
64+
# an extra boot partition
65+
#
66+
# All of the following is more than a hack and I
67+
# don't like it all
68+
#
69+
# Complains and discussions about this please with
70+
# the SUSE kernel team as we in kiwi can just live
71+
# with the consequences of this change
72+
#
73+
pushd /
74+
75+
for file in /boot/* /boot/.*; do
76+
if [ -L "${file}" ];then
77+
link_target=$(readlink "${file}")
78+
if [[ "${link_target}" =~ usr/lib/modules ]];then
79+
mv "${link_target}" "${file}"
80+
fi
81+
fi
82+
done
83+
fi
84+
done

‎build-tests/s390/tumbleweed/test-image-MicroOS/root/etc/dracut.conf.d/oem_resize.conf‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
add_dracutmodules+=" kiwi-repart "

‎build-tests/s390/tumbleweed/test-image-MicroOS/root/etc/fstab.script‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
#!/bin/sh
2+
set -eux
3+
4+
/usr/sbin/setup-fstab-for-overlayfs
5+
# If /var is on a different partition than /...
6+
if [ "$(findmnt -snT / -o SOURCE)" != "$(findmnt -snT /var -o SOURCE)" ]; then
7+
# ... set options for autoexpanding /var
8+
gawk -i inplace '$2 == "/var" { $4 = $4",x-growpart.grow,x-systemd.growfs" } { print $0 }' /etc/fstab
9+
fi

‎build-tests/s390/tumbleweed/test-image-MicroOS/root/etc/systemd/network/20-local.network‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
[Match]
2+
Name=eth0
3+
4+
[Network]
5+
DHCP=yes
6+
7+
[DHCP]
8+
ClientIdentifier=mac

‎build-tests/s390/tumbleweed/test-image-MicroOS/run‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
#!/bin/bash
2+
3+
qemu-system-s390x \
4+
-cpu host \
5+
-machine accel=kvm,usb=off \
6+
-netdev user,id=user0 \
7+
-device virtio-net-ccw,netdev=user0 \
8+
-object s390-pv-guest,id=pv0 \
9+
-machine confidential-guest-support=pv0 \
10+
-enable-kvm \
11+
-nodefaults \
12+
-name suse-cc \
13+
-nographic \
14+
-drive id=disk0,file="$1",format=qcow2,if=none,cache=writeback \
15+
-device virtio-blk,id=data0,drive=disk0,physical_block_size=512,logical_block_size=512 \
16+
-device virtio-serial-ccw \
17+
-device sclpconsole,chardev=console \
18+
-chardev stdio,id=console \
19+
-smp 4 \
20+
-m 4096 \
21+
-mem-prealloc

0 commit comments

Comments
 (0)