Skip to content

Commit

Permalink
Temporarily limit kernel command line length in Stage0 measurements (#…
Browse files Browse the repository at this point in the history
…4983)

* Temporarily limit kernel command line length in Stage0 measurements

As a temporary workaround for #4981, limit the kernel command line
included in the Stage0 DICE measurements to 256 chars (1024 bytes).

* Fail command line validation for long cmdlines unless skipped

Since the temporary workaround for #4981 truncates length command lines
to 256 characters, fail verification for any command lines >= 256
(characters since it may have been truncated), unless the reference
value is set to Skip.

* FIXUP: update TODO format per reviewer feedback

* FIXUP: fix formatting in updated TODOs

* FIXUP: workaround linter issue (b/333067027)
  • Loading branch information
kevinloughlin authored Apr 5, 2024
1 parent 571627b commit 0869b75
Show file tree
Hide file tree
Showing 2 changed files with 14 additions and 5 deletions.
9 changes: 6 additions & 3 deletions oak_attestation_verification/src/verifier.rs
Original file line number Diff line number Diff line change
Expand Up @@ -528,7 +528,10 @@ fn verify_kernel_layer(
)
.context("kernel failed verification")?;

if let Some(kernel_raw_cmd_line) = values.kernel_raw_cmd_line.as_ref() {
// TODO: b/331252282 - Remove temporary workaround for cmd line.
if let Some(kernel_raw_cmd_line) = values.kernel_raw_cmd_line.as_ref()
&& kernel_raw_cmd_line.len() < 256
{
verify_text(
now_utc_millis,
kernel_raw_cmd_line.as_str(),
Expand All @@ -540,7 +543,7 @@ fn verify_kernel_layer(
)
.context("kernel command line failed verification")?;
} else {
// Support missing kernel_raw_cmd_line but only if the corresponding reference
// Support invalid kernel_raw_cmd_line but only if the corresponding reference
// value is set to skip. This is a temporary workaround until all clients are
// migrated.
anyhow::ensure!(
Expand All @@ -553,7 +556,7 @@ fn verify_kernel_layer(
.as_ref(),
Some(text_reference_value::Type::Skip(_))
),
"No kernel_raw_cmd_line provided"
"No valid kernel_raw_cmd_line provided"
)
}

Expand Down
10 changes: 8 additions & 2 deletions stage0/src/lib.rs
Original file line number Diff line number Diff line change
Expand Up @@ -42,7 +42,7 @@ use x86_64::{
};
use zerocopy::AsBytes;

use crate::{kernel::KernelType, sev::GHCB_WRAPPER, smp::AP_JUMP_TABLE};
use crate::{alloc::string::ToString, kernel::KernelType, sev::GHCB_WRAPPER, smp::AP_JUMP_TABLE};

mod acpi;
mod acpi_tables;
Expand Down Expand Up @@ -308,11 +308,17 @@ pub fn rust64_start(encrypted: u64) -> ! {
log::debug!("ACPI table generation digest: sha2-256:{}", hex::encode(acpi_sha2_256_digest));
log::debug!("E820 table digest: sha2-256:{}", hex::encode(memory_map_sha2_256_digest));

// TODO: b/331252282 - Remove temporary workaround for cmd line length.
let cmdline_max_len = 256;
let measurements = oak_stage0_dice::Measurements {
acpi_sha2_256_digest,
kernel_sha2_256_digest: kernel_info.measurement,
cmdline_sha2_256_digest,
cmdline: cmdline.clone(),
cmdline: if cmdline.len() > cmdline_max_len {
cmdline[..cmdline_max_len].to_string()
} else {
cmdline.clone()
},
ram_disk_sha2_256_digest,
setup_data_sha2_256_digest,
memory_map_sha2_256_digest,
Expand Down

0 comments on commit 0869b75

Please sign in to comment.