For quote generation and remote attestation, Intel TDX VM
communicates with the QGSD (Quote Generation Service)
on the host via unix socket.
The unix socket can be specified via:
<launchSecurity type='tdx'>
...
<quoteGenerationService path='/var/run/tdx-qgs/qgs.socket'/>
</launchSecurity>
in case the path field is omitted, a default path is used.
This commit generates the needed rule in the dynamic AA profile
for the VM.
Signed-off-by: Hector Cao <[email protected]>
---
src/security/virt-aa-helper.c | 15 ++++++++++++++-
1 file changed, 14 insertions(+), 1 deletion(-)
diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-helper.c
index e932e79dab..c3c333e761 100644
--- a/src/security/virt-aa-helper.c
+++ b/src/security/virt-aa-helper.c
@@ -1395,8 +1395,21 @@ get_files(vahControl * ctl)
case VIR_DOMAIN_LAUNCH_SECURITY_SEV_SNP:
virBufferAddLit(&buf, " \"/dev/sev\" rw,\n");
break;
- case VIR_DOMAIN_LAUNCH_SECURITY_PV:
case VIR_DOMAIN_LAUNCH_SECURITY_TDX:
+ /* To communicate with the QGSD daemon running on the host, if we
use the unix socket,
+ * allow the VM to access to the unix socket.
+ */
+ if (ctl->def->sec->data.tdx.haveQGS) {
+ const char *qgsd_sock_file = QGS_UNIX_SOCKET_FILE;
+ if (ctl->def->sec->data.tdx.qgs_unix_path) {
+ qgsd_sock_file = ctl->def->sec->data.tdx.qgs_unix_path;
+ }
+ if (vah_add_file(&buf, qgsd_sock_file, "rw") != 0) {
+ return -1;
+ }
+ }
+ break;
+ case VIR_DOMAIN_LAUNCH_SECURITY_PV:
case VIR_DOMAIN_LAUNCH_SECURITY_NONE:
case VIR_DOMAIN_LAUNCH_SECURITY_LAST:
break;
--
2.43.0
