NuKVM/libvirt
3
0
Fork 0
mirror of https://github.com/libvirt/libvirt.git synced 2026-09-03 20:53:04 -05:00
Code Issues Packages Projects Releases Wiki Activity

qemu: Read back the profile name after creation of a TPM instance

Browse Source 
Get the JSON profile that the swtpm instance was created with from the
output of 'swtpm socket --tpm2 --print-info 0x20 --tpmstate ...'. Get the
name of the profile from the JSON and set it in the current and persistent
emulator descriptions as 'name' attribute and have the persistent
description stored with this update. The user should avoid setting this
'name' attribute since it is meant to be read-only. The following is
an example of how the XML could look like:

  <profile source='local:restricted' name='custom:restricted'/>

If the user provided no profile node, and therefore swtpm_setup picked its
default profile, the XML may now shows the 'name' attribute with the name
of the profile. This makes the 'source' attribute now optional.

  <profile name='default-v1'/>

Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
This commit is contained in:
Stefan Berger
2024-11-18 08:46:49 +01:00
committed by Michal Privoznik
parent 957bda01c8
commit d79542eec6
10 changed files with 137 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/formatdomain.rst
+9 -7
View File
@@ -8135,7 +8135,7 @@ Example: usage of the TPM Emulator
<active_pcr_banks>
<sha256/>
</active_pcr_banks>
<profile source='local:restricted' removeDisabled='check'/>
<profile source='local:restricted' removeDisabled='check' name='custom:restricted'/>
</backend>
</tpm>
</devices>
@@ -8233,12 +8233,14 @@ Example: usage of the TPM Emulator
``profile``
The ``profile`` node is used to set a profile for a TPM 2.0 given in the
source attribute. This profile will be set when the TPM is initially
created and after that cannot be changed anymore. If no profile is provided,
then swtpm will use the latest built-in 'default' profile or the default
profile set in swtpm_setup.conf. Otherwise swtpm_setup will search for a
profile with the given name with appended .json suffix in a configurable
local and then in a distro directory. If none could be found in either, it
will fall back trying to use a built-in one.
created and after that cannot be changed anymore. Once a profile has been
set the name attribute will be updated with the name of the profile that
is running. If no profile is provided, then swtpm will use the latest
built-in 'default' profile or the default profile set in swtpm_setup.conf.
Otherwise swtpm_setup will search for a profile with the given name with
appended .json suffix in a configurable local and then in a distro
directory. If none could be found in either, it will fall back trying to
use a built-in one.
The built-in 'null' profile provides backwards compatibility with
libtpms v0.9 but also restricts the user to use only TPM features that were