mirror of
https://github.com/torvalds/linux
synced 2024-10-08 04:12:40 +00:00
cbabf03c3e
The new efi_secret module exposes the confidential computing (coco) EFI secret area via securityfs interface. When the module is loaded (and securityfs is mounted, typically under /sys/kernel/security), a "secrets/coco" directory is created in securityfs. In it, a file is created for each secret entry. The name of each such file is the GUID of the secret entry, and its content is the secret data. This allows applications running in a confidential computing setting to read secrets provided by the guest owner via a secure secret injection mechanism (such as AMD SEV's LAUNCH_SECRET command). Removing (unlinking) files in the "secrets/coco" directory will zero out the secret in memory, and remove the filesystem entry. If the module is removed and loaded again, that secret will not appear in the filesystem. Signed-off-by: Dov Murik <dovmurik@linux.ibm.com> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com> Link: https://lore.kernel.org/r/20220412212127.154182-3-dovmurik@linux.ibm.com Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
17 lines
653 B
Plaintext
17 lines
653 B
Plaintext
# SPDX-License-Identifier: GPL-2.0-only
|
|
config EFI_SECRET
|
|
tristate "EFI secret area securityfs support"
|
|
depends on EFI && X86_64
|
|
select EFI_COCO_SECRET
|
|
select SECURITYFS
|
|
help
|
|
This is a driver for accessing the EFI secret area via securityfs.
|
|
The EFI secret area is a memory area designated by the firmware for
|
|
confidential computing secret injection (for example for AMD SEV
|
|
guests). The driver exposes the secrets as files in
|
|
<securityfs>/secrets/coco. Files can be read and deleted (deleting
|
|
a file wipes the secret from memory).
|
|
|
|
To compile this driver as a module, choose M here.
|
|
The module will be called efi_secret.
|