Extending OpenPOWER Boot Security to Guests
summary
Proposal to extend OpenPOWER secure boot into guests focuses on concrete compatibility steps: reuse host signature formats, verify guest kernels with a shim-style indirection that signs GRUB and payloads, and place key management into partition firmware/sloth key mgmt so admins can control signing keys. Implementation options use TPM and IMA measurements or a shim callback into GRUB; KVM uses QEMU/SLIM firmware while PowerVM uses partition firmware. Design discussion is preliminary, not yet implemented.
AI-written summary · about
chapters (12)
- 0:00LINUX SECURITY SUMMIT
- 1:13Background
- 5:17PowerVM Guest Boot
- 7:30Proposed PowerVM Secure Boot Scheme
- 8:20Firmware Signing
- 9:34Why not port the OpenPOWER host secure boot solution?
- 11:30X86 Guest Secure Boot with OVMF Emulates host solution
- 12:17PowerVM Linux Guest Secure Boot?
- 13:51OpenPOWER Guest Secure Book?
- 14:42Key Management
- 15:12How to Verify the Firmware
- 16:06Summary
related talks
33mOpenPOWER: Host OS (Linux Kernel) Secure Boot Key Management
35mUsing Linux as a Secure Boot Loader for OpenPOWER Servers
45mDynamic Key Managed PowerPC Guest Secure Boot
21mReconcilable Differences: Booting Linux on IBM PowerVM LPARs
26mHypervisor Based Integrity: Protect Guest Kernel in Cloud
31mSecure IO
45mUsing Secure Boot for the powers of good
22mBoot Requirements and Strategies for the Edge