Git-Mirrors/constellation
1
0
Fork 0
mirror of https://github.com/edgelesssys/constellation.git synced 2025-08-10 07:50:08 -04:00
Code Issues Projects Releases Packages Wiki Activity

AB#2316 Configurable enforced PCRs (#361)

Browse source 
* Add warnings for non enforced, untrusted PCRs

* Fix global state in Config PCR map

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
This commit is contained in:
Daniel Weiße 2022-08-12 15:59:45 +02:00 • committed by GitHub
parent 9478303f80
commit ba4471a228
30 changed files with 350 additions and 323 deletions
Download patch file Download diff file Expand all files Collapse all files

17
internal/watcher/validator.go
View file

@ -30,11 +30,11 @@ func NewValidator(log *logger.Logger, csp string, fileHandler file.Handler) (*Up
var newValidator newValidatorFunc
switch cloudprovider.FromString(csp) {
case cloudprovider.Azure:
newValidator = func(m map[uint32][]byte) atls.Validator { return azure.NewValidator(m) }
newValidator = func(m map[uint32][]byte, e []uint32) atls.Validator { return azure.NewValidator(m, e) }
case cloudprovider.GCP:
newValidator = func(m map[uint32][]byte) atls.Validator { return gcp.NewValidator(m) }
newValidator = func(m map[uint32][]byte, e []uint32) atls.Validator { return gcp.NewValidator(m, e) }
case cloudprovider.QEMU:
newValidator = func(m map[uint32][]byte) atls.Validator { return qemu.NewValidator(m) }
newValidator = func(m map[uint32][]byte, e []uint32) atls.Validator { return qemu.NewValidator(m, e) }
default:
return nil, fmt.Errorf("unknown cloud service provider: %q", csp)
}
@ -76,9 +76,16 @@ func (u *Updatable) Update() error {
}
u.log.Debugf("New measurements: %v", measurements)
u.Validator = u.newValidator(measurements)
var enforced []uint32
if err := u.fileHandler.ReadJSON(filepath.Join(constants.ServiceBasePath, constants.EnforcedPCRsFilename), &enforced); err != nil {
return err
}
u.log.Debugf("Enforced PCRs: %v", enforced)
u.Validator = u.newValidator(measurements, enforced)
u.Validator.AddLogger(u.log)
return nil
}
type newValidatorFunc func(measurements map[uint32][]byte) atls.Validator
type newValidatorFunc func(measurements map[uint32][]byte, enforcedPCRs []uint32) atls.Validator