[libvirt] [PATCH v8 07/18] qemu: Add support for external swtpm TPM emulator

[Ján Tomko]

On Thu, May 24, 2018 at 04:26:03PM -0400, Stefan Berger wrote:
>This patch adds support for an external swtpm TPM emulator. The XML for
>this type of TPM looks as follows:
>
> <tpm model='tpm-tis'>
>   <backend type='emulator'/>
> </tpm>
>
>The XML will currently only start a TPM 1.2.
>
>Upon first start, libvirt will run `swtpm_setup`, which will simulate the
>manufacturing of a TPM and create certificates for it and write them into
>NVRAM locations of the emulated TPM.
>
>After that libvirt starts the swtpm TPM emulator using the `swtpm` executable.
>
>Once the VM terminates, libvirt uses the swtpm_ioctl executable to gracefully
>shut down the `swtpm` in case it is still running (QEMU did not send shutdown)
>or clean up the socket file.
>
>The above mentioned executables must be found in the PATH.
>
>The executables can either be run as root or started as root and switch to
>the tss user. The requirement for the tss user comes through 'tcsd', which
>is used for the simulation of the manufacturing. Which user is used can be
>configured through qemu.conf. By default 'tss' is used.
>
>The swtpm writes out state into files. The state is kept in /var/lib/libvirt/swtpm:
>
>[root at localhost libvirt]# ls -lZ | grep swtpm
>
>drwx--x--x. 7 root root unconfined_u:object_r:virt_var_lib_t:s0 4096 Apr  5 16:22 swtpm
>
>The directory /var/lib/libvirt/swtpm maintains per-TPM state directories.
>(Using the uuid of the VM for that since the name can change per VM renaming but
> we need a stable directory name.)
>
>[root at localhost swtpm]# ls -lZ
>total 4
>drwx------. 2 tss  tss  system_u:object_r:virt_var_lib_t:s0          4096 Apr  5 16:46 485d0004-a48f-436a-8457-8a3b73e28568
>
>[root at localhost 485d0004-a48f-436a-8457-8a3b73e28568]# ls -lZ
>total 4
>drwx------. 2 tss tss system_u:object_r:virt_var_lib_t:s0 4096 Apr 10 21:34 tpm1.2
>
>[root at localhost tpm1.2]# ls -lZ
>total 8
>-rw-r--r--. 1 tss tss system_u:object_r:virt_var_lib_t:s0 3648 Apr  5 16:46 tpm-00.permall
>
>The directory /var/run/libvirt/qemu/swtpm/ hosts the swtpm.sock that
>QEMU uses to communicate with the swtpm:
>
>root at localhost domain-1-testvm]# ls -lZ
>total 0
>srw-------. 1 qemu qemu system_u:object_r:svirt_image_t:s0:c597,c632  0 Apr  6 10:24 1-testvm-swtpm.sock
>
>The logfile for the swtpm is in /var/log/swtpm/libvirt/qemu:
>
>[root at localhost-3 qemu]# ls -lZ
>total 4
>-rw-------. 1 tss tss unconfined_u:object_r:var_log_t:s0 2199 Apr  6 14:01 testvm-swtpm.log
>
>The processes are labeled as follows:
>
>[root at localhost 485d0004-a48f-436a-8457-8a3b73e28567]# ps auxZ | grep swtpm | grep socket | grep -v grep
>system_u:system_r:virtd_t:s0-s0:c0.c1023 tss 18697 0.0  0.0 28172 3892 ?       Ss   16:46   0:00 /usr/bin/swtpm socket --daemon --ctrl type=unixio,path=/var/run/libvirt/qemu/swtpm/1-testvm-swtpm.sock,mode=0600 --tpmstate dir=/var/lib/libvirt/swtpm/485d0004-a48f-436a-8457-8a3b73e28568/tpm1.2 --log file=/var/log/swtpm/libvirt/qemu/testvm-swtpm.log
>
>[root at localhost 485d0004-a48f-436a-8457-8a3b73e28567]# ps auxZ | grep qemu | grep tpm | grep -v grep
>system_u:system_r:svirt_t:s0:c413,c430 qemu 18702 2.5  0.0 3036052 48676 ?     Sl   16:46   0:08 /bin/qemu-system-x86_64 [...]
>
>Signed-off-by: Stefan Berger <stefanb at linux.vnet.ibm.com>
>Reviewed-by: John Ferlan <jferlan at redhat.com>
>---
> src/qemu/qemu_command.c | 33 ++++++++++++++++++++++++++++++---
> 1 file changed, 30 insertions(+), 3 deletions(-)
>

Reviewed-by: Ján Tomko <jtomko at redhat.com>

Jano
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: Digital signature
URL: <http://listman.redhat.com/archives/libvir-list/attachments/20180602/71137fb8/attachment-0001.sig>