diff --git a/README.md b/README.md index 584471c..7e8ff80 100644 --- a/README.md +++ b/README.md @@ -23,7 +23,10 @@ As a result, it enhances a platform user’s control of data security and IP pro Cloud Service Providers’ (CSP) ability to provide managed cloud services without exposing tenant data to adversaries. For more information, see the [Intel TDX overview](https://www.intel.com/content/www/us/en/developer/tools/trust-domain-extensions/overview.html). -This tech preview of TDX on Ubuntu 24.04 provides base host, guest, and remote attestation functionalities. Follow these instructions to setup the TDX host, create a TD guest, boot it, and attest the integrity of its execution environment. +This tech preview of TDX on Ubuntu 24.04 provides base host, guest, and remote attestation functionalities. +Follow these instructions to setup the TDX host, create a TD guest, boot it, and attest the integrity of its execution environment. + +The setup can be customized by editing the global configuration file : `setup-tdx-config` ## 2. Report an Issue @@ -45,14 +48,11 @@ the host into a TDX host, optionally install remote attestation components, and 3. Run the script.
-NOTE 1: If you'd like to have the attestation components installed automatically, change the value -of `TDX_SETUP_ATTESTATION` from `0` to `1`. - -NOTE 2: If you're behind a proxy, use `sudo -E` to preserve user environment. +NOTE: If you're behind a proxy, use `sudo -E` to preserve user environment. ```bash cd tdx -sudo TDX_SETUP_ATTESTATION=0 ./setup-tdx-host.sh +sudo ./setup-tdx-host.sh ``` 4. Reboot. @@ -87,7 +87,7 @@ NOTE: The following is a sample BIOS configuration. It may vary slightly from o sudo dmesg | grep -i tdx ``` -An example output: +The message `virt/tdx: module initialized` proves that the tdx has been properly initialized. Here is an example output: ``` ... @@ -103,31 +103,16 @@ In this section, you will create an Ubuntu 24.04-based TD guest from scratch or ### Create a New TD Guest Image -The base image is an Ubuntu 24.04 cloud image [`ubuntu-24.04-server-cloudimg-amd64.img`](https://cloud-images.ubuntu.com/noble/current/noble-server-cloudimg-amd64.img). You can be customized your preferences by setting these two environment variables before running the script: - -```bash -export OFFICIAL_UBUNTU_IMAGE="https://cloud-images.ubuntu.com/noble/current/" -export CLOUD_IMG="noble-server-cloudimg-amd64.img" -``` +The base image is an Ubuntu 24.04 cloud image. 1. Generate a TD guest image.
-NOTE 1: If you'd like to have the attestation components installed automatically, change the value -of `TDX_SETUP_ATTESTATION` from `0` to `1`. -NOTE 2: If you're behind a proxy, use `sudo -E` to preserve user environment. +NOTE: If you're behind a proxy, use `sudo -E` to preserve user environment. ```bash cd tdx/guest-tools/image/ # create tdx-guest-ubuntu-24.04-generic.qcow2 -sudo -E ./create-td-image.sh -``` - -The TD guest image uses the Ubuntu generic kernel by default, the intel kernel can be selected by using -the environment variable `TDX_SETUP_INTEL_KERNEL`. - -```bash -# create tdx-guest-ubuntu-24.04-intel.qcow2 -sudo TDX_SETUP_ATTESTATION=0 TDX_SETUP_INTEL_KERNEL=1 ./create-td-image.sh +sudo ./create-td-image.sh ``` Note that the kernel type (`generic` or `intel`) is automatically included in the image name so it is easy to distinguish. @@ -144,12 +129,9 @@ If you have an existing Ubuntu 24.04 non-TD guest, you can enable the TDX featur 3. Run the script. -NOTE: If you'd like to have the attestation components installed automatically, change the value -of `TDX_SETUP_ATTESTATION` from `0` to `1`. - ```bash cd tdx -sudo TDX_SETUP_ATTESTATION=0 ./setup-tdx-guest.sh +sudo ./setup-tdx-guest.sh ``` 4. Shutdown the guest. diff --git a/attestation/setup-attestation-guest.sh b/attestation/setup-attestation-guest.sh index 596146e..44c5d6f 100755 --- a/attestation/setup-attestation-guest.sh +++ b/attestation/setup-attestation-guest.sh @@ -9,7 +9,7 @@ apt install --yes software-properties-common add-apt-repository -y ppa:kobuk-team/tdx-release apt update -apt install --yes libtdx-attest-dev trustauthority-cli +apt install --yes --allow-downgrades libtdx-attest-dev trustauthority-cli # compile tdx-attest source apt install --yes build-essential diff --git a/attestation/setup-attestation-host.sh b/attestation/setup-attestation-host.sh index bea8107..29d5463 100755 --- a/attestation/setup-attestation-host.sh +++ b/attestation/setup-attestation-host.sh @@ -10,11 +10,11 @@ add-apt-repository -y ppa:kobuk-team/tdx-release apt update -apt install --yes sgx-dcap-pccs tdx-qgs +apt install --yes --allow-downgrades sgx-dcap-pccs tdx-qgs # using RA registration (direct registration method) -apt install --yes sgx-ra-service +apt install --yes --allow-downgrades sgx-ra-service # using indirect registration method -apt install --yes sgx-pck-id-retrieval-tool +apt install --yes --allow-downgrades sgx-pck-id-retrieval-tool diff --git a/guest-tools/image/create-td-image.sh b/guest-tools/image/create-td-image.sh index 0191fb0..0d6de5e 100755 --- a/guest-tools/image/create-td-image.sh +++ b/guest-tools/image/create-td-image.sh @@ -16,9 +16,15 @@ # # TODO : ask cloud init to run the TDX setup script +CURR_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd ) + +# source config file +if [ -f ${CURR_DIR}/../../setup-tdx-config ]; then + source ${CURR_DIR}/../../setup-tdx-config +fi + LOGFILE=/tmp/tdx-guest-setup.txt WORK_DIR=${PWD} -CURR_DIR=$(dirname "$(realpath $0)") FORCE_RECREATE=false OFFICIAL_UBUNTU_IMAGE=${OFFICIAL_UBUNTU_IMAGE:-"https://cloud-images.ubuntu.com/releases/noble/release/"} CLOUD_IMG=${CLOUD_IMG:-"ubuntu-24.04-server-cloudimg-amd64.img"} @@ -216,16 +222,14 @@ EOT } setup_guest_image() { - # export environment variables to guest - # all environment variables with prefix : TDX_SETUP_ - declare -px | grep TDX_SETUP_ > ${CURR_DIR}/tdx-guest-setup-env virt-customize -a /tmp/${GUEST_IMG} \ - --copy-in ${CURR_DIR}/setup.sh:/tmp/ \ - --copy-in ${CURR_DIR}/../../setup-tdx-guest.sh:/tmp/ \ - --copy-in ${CURR_DIR}/../../setup-tdx-common:/tmp/ \ - --copy-in ${CURR_DIR}/../../attestation/:/tmp/ \ - --copy-in ${CURR_DIR}/tdx-guest-setup-env:/tmp/ \ - --run-command "/tmp/setup.sh" + --mkdir /tmp/tdx/ \ + --copy-in ${CURR_DIR}/setup.sh:/tmp/tdx/ \ + --copy-in ${CURR_DIR}/../../setup-tdx-guest.sh:/tmp/tdx/ \ + --copy-in ${CURR_DIR}/../../setup-tdx-common:/tmp/tdx \ + --copy-in ${CURR_DIR}/../../setup-tdx-config:/tmp/tdx \ + --copy-in ${CURR_DIR}/../../attestation/:/tmp/tdx \ + --run-command "/tmp/tdx/setup.sh" if [ $? -eq 0 ]; then ok "Setup guest image..." else diff --git a/guest-tools/image/setup.sh b/guest-tools/image/setup.sh index 0968cb5..16c4f3c 100755 --- a/guest-tools/image/setup.sh +++ b/guest-tools/image/setup.sh @@ -1,10 +1,5 @@ #!/bin/bash -# caller can set a list of environment variables by putting them into the file /tmp/tdx-guest-setup-env -if [ -f /tmp/tdx-guest-setup-env ]; then - source /tmp/tdx-guest-setup-env -fi - apt update # Utilities packages for automated testing @@ -18,4 +13,6 @@ sed -i 's|[#]*PermitRootLogin .*|PermitRootLogin yes|g' /etc/ssh/sshd_config sed -i 's|[#]*KbdInteractiveAuthentication .*|KbdInteractiveAuthentication yes|g' /etc/ssh/sshd_config # Enable TDX -/tmp/setup-tdx-guest.sh +/tmp/tdx/setup-tdx-guest.sh + +rm -rf /tmp/tdx || true diff --git a/setup-tdx-config b/setup-tdx-config new file mode 100644 index 0000000..1e41b5f --- /dev/null +++ b/setup-tdx-config @@ -0,0 +1,42 @@ +################################################################ +# GENERAL # +################################################################ + +################################################################ +# Enable the setup of attestation components +# Set to 1 to enable +# By default, the attestation components are not installed +################################################################ +TDX_SETUP_ATTESTATION=0 + +################################################################ +# HOST # +################################################################ + + +################################################################ +# GUEST # +################################################################ + +################################################################ +# Enable the intel optimized kernel for the guest +# Set to 1 to enable +# By default, the generic kernel is used +################################################################ +TDX_SETUP_INTEL_KERNEL=0 + +################################################################ +# Image configuration +# The base image is an Ubuntu 24.04 cloud image +# You can use a different image setting these two environment +# variables before running the setup script +################################################################ +OFFICIAL_UBUNTU_IMAGE="https://cloud-images.ubuntu.com/releases/noble/release/" +CLOUD_IMG="ubuntu-24.04-server-cloudimg-amd64.img" + +################################################################ +# Configure the guest credentials +################################################################ +GUEST_USER="tdx" +GUEST_PASSWORD="123456" +GUEST_HOSTNAME="tdx-guest" diff --git a/setup-tdx-guest.sh b/setup-tdx-guest.sh index d7e1c46..13f62fd 100755 --- a/setup-tdx-guest.sh +++ b/setup-tdx-guest.sh @@ -2,11 +2,16 @@ SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd ) +# source config file +if [ -f ${SCRIPT_DIR}/setup-tdx-config ]; then + source ${SCRIPT_DIR}/setup-tdx-config +fi + # the kernel flavour/type we want to use KERNEL_TYPE=linux-image-generic # use can use -intel kernel by setting TDX_SETUP_INTEL_KERNEL -if [ -n "${TDX_SETUP_INTEL_KERNEL}" ]; then +if [[ "${TDX_SETUP_INTEL_KERNEL}" == "1" ]]; then KERNEL_TYPE=linux-image-intel fi diff --git a/setup-tdx-host.sh b/setup-tdx-host.sh index a0b9e82..7b5c151 100755 --- a/setup-tdx-host.sh +++ b/setup-tdx-host.sh @@ -2,6 +2,11 @@ SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd ) +# source config file +if [ -f ${SCRIPT_DIR}/setup-tdx-config ]; then + source ${SCRIPT_DIR}/setup-tdx-config +fi + on_exit() { rc=$? if [ ${rc} -ne 0 ]; then