From 2faaec358d2274b0998f01494a36dfad446104f8 Mon Sep 17 00:00:00 2001 From: Amaury Chamayou Date: Tue, 19 Dec 2023 13:30:59 +0000 Subject: [PATCH] Remove now-unused security_context_directory (#5868) --- .daily_canary | 2 +- .snpcc_canary | 2 +- CHANGELOG.md | 1 + doc/host_config_schema/cchost_config.json | 12 ------ doc/operations/platforms/snp.rst | 9 ++-- include/ccf/node/startup_config.h | 3 -- samples/config/start_config_aci_sev_snp.json | 7 +--- src/common/configuration.h | 6 +-- src/host/main.cpp | 43 -------------------- src/node/node_state.h | 39 +++--------------- tests/infra/remote.py | 5 --- 11 files changed, 15 insertions(+), 114 deletions(-) diff --git a/.daily_canary b/.daily_canary index d96c703b9db1..bf64b9f1b892 100644 --- a/.daily_canary +++ b/.daily_canary @@ -1,4 +1,4 @@ -^- ___ ___ (- -) (= =) | Y & +--? ( V ) / . \ | +---=---' -/--x-m- /--n-n---xXx--/--yY------>>>----<<<>>]]{{}}---||-/\---/\__ \ No newline at end of file +/--x-m- /--n-n---xXx--/--yY------>>>----<<<>>]]{{}}---||-/\---.. \ No newline at end of file diff --git a/.snpcc_canary b/.snpcc_canary index 64409b594064..3359f5de091b 100644 --- a/.snpcc_canary +++ b/.snpcc_canary @@ -2,4 +2,4 @@ (. =) Y (0 0) (x X) Y O \ o | / /-xXx--//-----x=x--/-xXx--/---x---->>>--/ -...... \ No newline at end of file +........ \ No newline at end of file diff --git a/CHANGELOG.md b/CHANGELOG.md index 2953acf6108e..d8d4f9a68646 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -13,6 +13,7 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0. - `ccf::historical::adapter_v2` is removed, replaced by `ccf::historical::adapter_v3` first introduced in 2.0.0. - `ccf::EnclaveAttestationProvider` has been removed. It is replaced by `ccf::AttestationProvider` +- The `attestation.environment.security_context_directory` configuration entry and `--snp-security-context-dir-var` CLI option have been removed. SNP collateral must now be provided through the `snp_security_policy_file`, `snp_uvm_endorsements_file` and `snp_endorsement_servers` configuration values. See [documentation](https://microsoft.github.io/CCF/main/operations/platforms/snp.html) for details and platform-specific configuration samples. ## [5.0.0-dev10] diff --git a/doc/host_config_schema/cchost_config.json b/doc/host_config_schema/cchost_config.json index b3466ec2bab8..5fc5a63ef259 100644 --- a/doc/host_config_schema/cchost_config.json +++ b/doc/host_config_schema/cchost_config.json @@ -444,18 +444,6 @@ "attestation": { "type": "object", "properties": { - "environment": { - "type": "object", - "properties": { - "security_context_directory": { - "type": ["string", "null"], - "description": "DEPRECATED: Replaced by --snp-security-context-dir-var CLI argument. Name of environment variable (e.g. ``UVM_SECURITY_CONTEXT_DIR``) specifying the directory containing the security context files (i.e. ``host-amd-cert-base64``, ``security-policy-base64`` and ``reference-info-base64``)." - } - }, - "description": "Environment variables required to provide best auditability and serviceability for Azure Container Instance deployments (SEV-SNP only)", - "required": [], - "additionalProperties": false - }, "snp_security_policy_file": { "type": ["string", "null"], "description": "Path to file containing the security policy (SEV-SNP only), can contain environment variables, such as $UVM_SECURITY_CONTEXT_DIR" diff --git a/doc/operations/platforms/snp.rst b/doc/operations/platforms/snp.rst index 620d37e6d4e9..ca30e7860401 100644 --- a/doc/operations/platforms/snp.rst +++ b/doc/operations/platforms/snp.rst @@ -18,13 +18,14 @@ Confidential Azure Container Instance (ACI) .. note:: See `here `_ for more information on the deployment of confidential containers in Azure. -Azure Confidential ACI provides a security context directory containing the following files. The content of these files are checked against the attestation report on node startup and join, and stored in the ledger for audit and improved serviceability. +Azure Confidential ACI provides a security context directory containing the following files. -- ``host-amd-cert-base64``: The certificate chain corresponding to the key (VCEK) used to sign the attestation report, up to the well-known AMD root of trust certificate authority (Base64 encoded). - ``security-policy-base64``: The security policy [#security_policy]_ describing the state and transitions allowed for the container (Base64 encoded). The SHA256 hash of the decoded value should match the attestation report ``host_data``. This value is stored in the :ref:`audit/builtin_maps:``nodes.snp.host_data``` table. - ``reference-info-base64``: The COSE Sign1 document containing the measurement [#measurement]_ of the utility VM (UVM) used to launch the container (Base64 encoded). The measurement contained in the document payload should match the report ``measurement``. If set, the value is stored in the :ref:`audit/builtin_maps:``nodes.snp.uvm_endorsements``` table and new nodes must present measurement endorsements from the same issuer (`did:x509`) to be trusted. -The location of the security context directory is passed to the container's startup command as the ``UVM_SECURITY_CONTEXT_DIR`` environment variable. The name of an alternative environment variable may be specified as the value of the ``--snp-security-context-dir-var`` CLI argument, if an alternative trust root is needed. +The location of the security context directory is passed to the container's startup command as the ``UVM_SECURITY_CONTEXT_DIR`` environment variable. CCF can be configured to fetch the security policy and UVM endorsements from the security context directory by setting the ``snp_security_policy_file`` and ``snp_uvm_endorsements_file`` configuration options, respectively. + +AMD endorsements must be fetched, preferably from the THIM service, but configuring the Azure cache or the AMD server is also possible. .. tip:: See :ccf_repo:`samples/config/start_config_aci_sev_snp.json` for a sample node configuration for ACI deployments. @@ -41,8 +42,6 @@ The security policy must be provided by the operator, and will be picked up by C AMD endorsements must be fetched, preferably from the THIM service, but configuring the Azure cache or the AMD server is also possible. -The location of the security context directory is passed to the container's startup command as the ``UVM_SECURITY_CONTEXT_DIR`` environment variable. The name of an alternative environment variable may be specified as the value of the ``--snp-security-context-dir-var`` CLI argument, if an alternative trust root is needed. - .. tip:: See :ccf_repo:`samples/config/start_config_aks_sev_snp.json` for a sample node configuration for Confidential AKS deployments. diff --git a/include/ccf/node/startup_config.h b/include/ccf/node/startup_config.h index 33b88b112613..a84f3360209c 100644 --- a/include/ccf/node/startup_config.h +++ b/include/ccf/node/startup_config.h @@ -61,11 +61,8 @@ struct CCFConfig struct Environment { - std::optional security_context_directory = std::nullopt; - std::optional security_policy = std::nullopt; std::optional uvm_endorsements = std::nullopt; - std::optional report_endorsements = std::nullopt; bool operator==(const Environment&) const = default; }; diff --git a/samples/config/start_config_aci_sev_snp.json b/samples/config/start_config_aci_sev_snp.json index 63854909263e..81d050d4fb81 100644 --- a/samples/config/start_config_aci_sev_snp.json +++ b/samples/config/start_config_aci_sev_snp.json @@ -34,13 +34,10 @@ } }, "attestation": { - "environment": { - "security_context_directory": "UVM_SECURITY_CONTEXT_DIR" - }, "snp_endorsements_servers": [ { - "type": "THIM", - "url": "169.254.169.254" + "type": "Azure", + "url": "global.acccache.azure.net" } ], "snp_security_policy_file": "$UVM_SECURITY_CONTEXT_DIR/security-policy-base64", diff --git a/src/common/configuration.h b/src/common/configuration.h index 25a4918e7294..2b4958a79727 100644 --- a/src/common/configuration.h +++ b/src/common/configuration.h @@ -71,11 +71,7 @@ DECLARE_JSON_OPTIONAL_FIELDS(CCFConfig::JWT, key_refresh_interval); DECLARE_JSON_TYPE_WITH_OPTIONAL_FIELDS(CCFConfig::Attestation::Environment); DECLARE_JSON_REQUIRED_FIELDS(CCFConfig::Attestation::Environment); DECLARE_JSON_OPTIONAL_FIELDS( - CCFConfig::Attestation::Environment, - security_context_directory, - security_policy, - uvm_endorsements, - report_endorsements); + CCFConfig::Attestation::Environment, security_policy, uvm_endorsements); DECLARE_JSON_TYPE_WITH_OPTIONAL_FIELDS(CCFConfig::Attestation); DECLARE_JSON_REQUIRED_FIELDS(CCFConfig::Attestation); diff --git a/src/host/main.cpp b/src/host/main.cpp index 04c763099810..b229417d785f 100644 --- a/src/host/main.cpp +++ b/src/host/main.cpp @@ -124,15 +124,6 @@ int main(int argc, char** argv) enclave_file_path, "Path to enclave application (security critical)"); - std::string snp_security_context_dir_var = "UVM_SECURITY_CONTEXT_DIR"; - app - .add_option( - "--snp-security-context-dir-var", - snp_security_context_dir_var, - "Name of environment variable specifying the directory containing the " - "SNP UVM security context files (security critical)") - ->capture_default_str(); - try { app.parse(argc, argv); @@ -510,40 +501,6 @@ int main(int argc, char** argv) startup_config.snapshot_tx_interval = config.snapshots.tx_count; - if (config.attestation.environment.security_context_directory.has_value()) - { - LOG_FAIL_FMT( - "DEPRECATED: security_context_dir was specified in config file! This " - "should be removed from the config, and passed directly to the CLI. " - "Note that the CLI provides a default value, which may be sufficient"); - - snp_security_context_dir_var = - config.attestation.environment.security_context_directory.value(); - } - - // This will be deprecated in favour of explicit configuration entries, - // such as snp_security_policy_file and snp_endorsements_servers - if (config.enclave.platform == host::EnclavePlatform::SNP) - { - auto dir = read_required_environment_variable( - snp_security_context_dir_var, "security context directory"); - - constexpr auto security_policy_filename = "security-policy-base64"; - startup_config.attestation.environment.security_policy = - files::try_slurp_string( - fs::path(dir) / fs::path(security_policy_filename)); - - constexpr auto uvm_endorsements_filename = "reference-info-base64"; - startup_config.attestation.environment.uvm_endorsements = - files::try_slurp_string( - fs::path(dir) / fs::path(uvm_endorsements_filename)); - - constexpr auto report_endorsements_filename = "host-amd-cert-base64"; - startup_config.attestation.environment.report_endorsements = - files::try_slurp_string( - fs::path(dir) / fs::path(report_endorsements_filename)); - } - if (startup_config.attestation.snp_security_policy_file.has_value()) { auto security_policy_file = diff --git a/src/node/node_state.h b/src/node/node_state.h index 265978caff6f..e2b9eb905a90 100644 --- a/src/node/node_state.h +++ b/src/node/node_state.h @@ -405,10 +405,12 @@ namespace ccf // Note: Node lock is already taken here as this is called back // synchronously with the call to pal::generate_quote - if ( - qi.format == QuoteFormat::amd_sev_snp_v1 && - !config.attestation.snp_endorsements_servers.empty()) + if (qi.format == QuoteFormat::amd_sev_snp_v1) { + CCF_ASSERT_FMT( + !config.attestation.snp_endorsements_servers.empty(), + "One or more SNP endorsements servers must be specified to fetch " + "the collateral for the attestation"); // On SEV-SNP, fetch endorsements from servers if specified quote_endorsements_client = std::make_shared( @@ -440,37 +442,6 @@ namespace ccf "SGX quote generation should have already fetched endorsements"); quote_info = qi; - - if ( - quote_info.format == QuoteFormat::amd_sev_snp_v1 && - config.attestation.environment.report_endorsements.has_value()) - { - // On SEV-SNP, if reports endorsements are passed via - // environment, read those - pal::snp::ACIReportEndorsements endorsements = - nlohmann::json::parse(crypto::raw_from_b64( - config.attestation.environment.report_endorsements.value())); - - CCF_ASSERT_FMT( - quote_info.endorsements.empty(), - "No endorsements should be set by quote generation"); - - quote_info.endorsements.insert( - quote_info.endorsements.end(), - endorsements.vcek_cert.begin(), - endorsements.vcek_cert.end()); - quote_info.endorsements.insert( - quote_info.endorsements.end(), - endorsements.certificate_chain.begin(), - endorsements.certificate_chain.end()); - - // Endianness of ACI report endorsements tcbm retrieved from - // environment is reversed - auto raw_tcb = ds::from_hex(endorsements.tcbm); - std::reverse(raw_tcb.begin(), raw_tcb.end()); - quote_info.endorsed_tcb = ds::to_hex(raw_tcb); - } - launch_node(); }; diff --git a/tests/infra/remote.py b/tests/infra/remote.py index 46e199f63ddd..0a1690304c54 100644 --- a/tests/infra/remote.py +++ b/tests/infra/remote.py @@ -865,11 +865,6 @@ def __init__( "--enclave-file", self.enclave_file, ] - if snp_security_context_directory_envvar is not None: - cmd += [ - "--snp-security-context-dir-var", - snp_security_context_directory_envvar, - ] if start_type == StartType.start: members_info = kwargs.get("members_info")