[PATCH 0/5] vm: boot sub-VMs from dm-verity roots and enable IPE

[colbyt <colby@colbyt.com>]

This series changes the app VM and net VM root images to boot through
dm-verity, then enables IPE kernel support for the sub-VMs and the
Spectrum host rootfs.

Each sub-VM disk now has a verity metadata partition and an EROFS root
partition.  The build installs the root hash next to the disk image, and
the VM boot paths pass that hash to a shared initramfs.  The initramfs
uses the hash to find both partitions, opens /dev/mapper/root-verity, and
switches into it read-only.

The last two patches only enable kernel support for IPE.  They do not
install an IPE policy.  With the existing generated kernel config,
enabling SECURITY_IPE also enables the dm-verity root-hash provider, so
later policy work can match files from verified roots.

This is based on current main and does not depend on the Cloud Hypervisor
v52 series.  If the v52 series lands first, the only expected overlap is
the crosvm run target context in patch 3.

Tested:

- nix-build tools -A tests.tests -o /tmp/spectrum-ipe-standalone-tools-tests --no-build-output
- nix-build vm/sys/net -o /tmp/spectrum-ipe-standalone-netvm --no-build-output
- nix-build img/app -o /tmp/spectrum-ipe-standalone-appvm --no-build-output
- built app VM, net VM, and host kernel configfiles and confirmed:
  CONFIG_SECURITY_IPE=y
  CONFIG_IPE_PROP_DM_VERITY=y
  CONFIG_DM_VERITY=m
  CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,ipe,bpf"
- booted the net VM root image with QEMU and confirmed:
  LSM: initializing lsm=capability,landlock,yama,ipe,bpf
  device-mapper: verity: sha256 using "sha256-lib"
  erofs (device dm-0): mounted
  s6-linux-init version 1.1.3.0

colbyt (5):
  vm: generate dm-verity metadata for sub-VM roots
  vm: add shared initramfs for verified roots
  vm: boot sub-VMs through verified roots
  vm: enable IPE in sub-VM kernels
  host/rootfs: enable IPE in the host kernel

 host/rootfs/default.nix                   |   6 +-
 img/app/Makefile                          |  41 ++++++--
 img/app/default.nix                       |  14 ++-
 pkgs/default.nix                          |   1 +
 tools/start-vmm/ch.rs                     |   3 +-
 tools/start-vmm/lib.rs                    |  15 ++-
 tools/start-vmm/tests/vm_command-basic.rs |  18 +++-
 vm-lib/make-vm.nix                        |   2 +
 vm/initramfs/Makefile                     |  37 +++++++
 vm/initramfs/default.nix                  | 113 ++++++++++++++++++++++
 vm/initramfs/etc/fstab                    |   5 +
 vm/initramfs/etc/getuuids                 |  18 ++++
 vm/initramfs/etc/init                     |  58 +++++++++++
 vm/initramfs/etc/mdev.conf                |   4 +
 vm/initramfs/etc/probe                    |  17 ++++
 vm/sys/net/Makefile                       |  41 ++++++--
 vm/sys/net/default.nix                    |  14 ++-
 17 files changed, 380 insertions(+), 27 deletions(-)
 create mode 100644 vm/initramfs/Makefile
 create mode 100644 vm/initramfs/default.nix
 create mode 100644 vm/initramfs/etc/fstab
 create mode 100755 vm/initramfs/etc/getuuids
 create mode 100755 vm/initramfs/etc/init
 create mode 100644 vm/initramfs/etc/mdev.conf
 create mode 100755 vm/initramfs/etc/probe

-- 
2.54.0