product_policy: enforce UEFI security policy, ephemeral VMGS, and Secure AVIC#4000
Draft
mayank-microsoft wants to merge 1 commit into
Draft
product_policy: enforce UEFI security policy, ephemeral VMGS, and Secure AVIC#4000mayank-microsoft wants to merge 1 commit into
mayank-microsoft wants to merge 1 commit into
Conversation
…ure AVIC Wire the measured product policy into runtime and build-time enforcement: - uefi_security_policy: parse the custom UEFI JSON and enforce Replace-mode secure boot signatures, self-contained PK/KEK/db/dbx, and BootConfigurationDataHash presence; add get_validated_uefi_json and enforce_ephemeral_vmgs_required. - underhill_core: enforce the secure-boot policy and ephemeral-VMGS requirement, and prefer the policy's validated UEFI JSON over the host VMGS store. - loader/paravisor: run the same validation at build time. - CwcowPolicy::enforce_secure_avic, sourced from SnpBackedShared (x86_64 only). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 9828afc4-c610-4883-bee1-816052ce7328
Contributor
There was a problem hiding this comment.
Pull request overview
This PR tightens measured product policy enforcement across build-time (IGVM generation / loader validation) and runtime (Underhill/OpenHCL VM bring-up), adding mandatory checks for UEFI secure-boot policy details, ephemeral VMGS requirements, and (on SNP x86_64) Secure AVIC, with policy-sourced validated UEFI NVRAM state.
Changes:
- Enforce secure-boot policy constraints by validating the policy-provided custom UEFI JSON (Replace-mode signatures, self-contained PK/KEK/db/dbx, optional BCD hash requirements) at build time and runtime.
- Enforce ephemeral VMGS requirement early (before any VMGS open) and prefer measured policy-sourced custom UEFI vars over host VMGS CUSTOM_UEFI data.
- Plumb Secure AVIC state from the SNP backing into policy validation and add/expand product_policy tests.
Reviewed changes
Copilot reviewed 10 out of 11 changed files in this pull request and generated 5 comments.
Show a summary per file
| File | Description |
|---|---|
vm/loader/src/paravisor.rs |
Adds build-time validation for secure-boot policy enforcement when policy flags require it. |
openhcl/virt_mshv_vtl/src/processor/snp/mod.rs |
Exposes secure_avic within the crate so it can be queried by the partition API. |
openhcl/virt_mshv_vtl/src/lib.rs |
Adds UhPartition::secure_avic_enabled() (x86_64-only) to surface hardware Secure AVIC state. |
openhcl/underhill_core/src/worker.rs |
Enforces ephemeral-VMGS requirement before opening VMGS; prefers measured-policy UEFI vars over VMGS CUSTOM_UEFI. |
openhcl/underhill_core/src/measured_product_policy.rs |
Adds runtime enforcement for secure-boot policy details, ephemeral VMGS, measured UEFI nvram application, and Secure AVIC policy enforcement; adds a decode-size integrity test. |
openhcl/product_policy/src/uefi_security_policy.rs |
Extends UefiSecurityPolicy with secure-boot-policy enforcement validation, validated UEFI JSON access, and ephemeral-VMGS enforcement helpers. |
openhcl/product_policy/src/tests.rs |
Adds focused tests for secure-boot flag behavior and secure-boot-policy enforcement validation. |
openhcl/product_policy/src/sivm.rs |
Wires additional policy field accessors into the shared UEFI security policy validation trait. |
openhcl/product_policy/src/cwcow.rs |
Wires additional policy field accessors and adds Secure AVIC enforcement method. |
openhcl/product_policy/Cargo.toml |
Adds workspace deps needed for parsing/validating custom UEFI JSON deltas and GUID checks. |
Cargo.lock |
Locks new transitive deps for the product_policy crate. |
Comment on lines
32
to
38
| fn validate_uefi_security_policy( | ||
| policy: &dyn UefiSecurityPolicy, | ||
| vm: &LoadedVm, | ||
| ) -> anyhow::Result<()> { | ||
| policy.validate_secure_boot_enabled(vm.device_platform_settings.general.secure_boot_enabled)?; | ||
| policy.validate_secure_boot_policy_enforcement()?; | ||
| Ok(()) |
Comment on lines
77
to
+85
| @@ -43,5 +82,39 @@ | |||
| loaded_vm | |||
| .measured_product_policy | |||
| .cwcow(|p| validate_uefi_security_policy(p, loaded_vm))?; | |||
|
|
|||
Comment on lines
+60
to
+75
| /// Return the measured, validated UEFI nvram state from the policy applied onto | ||
| /// `base_vars`, or `None` when the policy is not present. | ||
| pub fn measured_uefi_nvram_state( | ||
| policy: &MeasuredProductPolicy, | ||
| base_vars: &CustomVars, | ||
| ) -> anyhow::Result<Option<CustomVars>> { | ||
| let uefi_state_json = policy | ||
| .sivm(validated_uefi_json_fn)? | ||
| .or(policy.cwcow(validated_uefi_json_fn)?); | ||
| if let Some(uefi_state) = uefi_state_json { | ||
| let delta = hyperv_uefi_custom_vars_json::load_delta_from_json(&uefi_state)?; | ||
| let measured = base_vars.clone().apply_delta(delta)?; | ||
| return Ok(Some(measured)); | ||
| } | ||
| Ok(None) | ||
| } |
Comment on lines
+41
to
+50
| /// Enforce the policy's ephemeral-VMGS requirement, called before the VMGS is | ||
| /// opened so a policy requiring ephemeral can't trigger a host-VMGS read. | ||
| pub fn enforce_ephemeral_vmgs( | ||
| policy: &MeasuredProductPolicy, | ||
| guest_state_lifetime: GuestStateLifetime, | ||
| ) -> anyhow::Result<()> { | ||
| let vmgs_is_ephemeral = matches!(guest_state_lifetime, GuestStateLifetime::Ephemeral); | ||
| policy.sivm(|p| p.enforce_ephemeral_vmgs_required(vmgs_is_ephemeral))?; | ||
| policy.cwcow(|p| p.enforce_ephemeral_vmgs_required(vmgs_is_ephemeral))?; | ||
| Ok(()) |
Comment on lines
+41
to
+51
| /// Enforce the policy's ephemeral-VMGS requirement, called before the VMGS is | ||
| /// opened so a policy requiring ephemeral can't trigger a host-VMGS read. | ||
| pub fn enforce_ephemeral_vmgs( | ||
| policy: &MeasuredProductPolicy, | ||
| guest_state_lifetime: GuestStateLifetime, | ||
| ) -> anyhow::Result<()> { | ||
| let vmgs_is_ephemeral = matches!(guest_state_lifetime, GuestStateLifetime::Ephemeral); | ||
| policy.sivm(|p| p.enforce_ephemeral_vmgs_required(vmgs_is_ephemeral))?; | ||
| policy.cwcow(|p| p.enforce_ephemeral_vmgs_required(vmgs_is_ephemeral))?; | ||
| Ok(()) | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Enforces the measured product policy at runtime and build time: UEFI secure-boot policy (Replace-mode signatures, self-contained PK/KEK/db/dbx, BCD-hash presence), ephemeral-VMGS requirement, policy-sourced validated UEFI JSON, and Secure AVIC (x86_64, sourced from
SnpBackedShared).Builds on the product policy support added in #3572.