Re: [PATCH 5/5] host/rootfs: enable IPE in the host kernel

[Alyssa Ross <hi@alyssa.is>]

[-- Attachment #1: Type: text/plain, Size: 1139 bytes --]

colbyt <colby@colbyt.com> writes:

> Enable the IPE LSM in the host kernel used by the Spectrum rootfs,
> including the QEMU host-rootfs run path.
>
> The generated kernel config already enables audit, audit syscall support,
> securityfs, and an LSM order containing ipe. Enabling SECURITY_IPE also
> selects the dm-verity root-hash provider for the host rootfs.
>
> This only enables kernel support. It does not install an IPE policy.
>
> Signed-off-by: colbyt <colby@colbyt.com>
> ---
>  host/rootfs/default.nix | 6 +++++-
>  1 file changed, 5 insertions(+), 1 deletion(-)
>
> diff --git a/host/rootfs/default.nix b/host/rootfs/default.nix
> index 6bfeefb..79baea4 100644
> --- a/host/rootfs/default.nix
> +++ b/host/rootfs/default.nix
> @@ -51,7 +51,11 @@ let
>      system.stateVersion = trivial.release;
>    });
>  
> -  kernel = linux_latest;
> +  kernel = linux_latest.override {
> +    structuredExtraConfig = with lib.kernel; {
> +      SECURITY_IPE = yes;
> +    };
> +  };

Just noting that we'll get this for free when we update Nixpkgs, as it's
now enabled in Nixpkgs' default kernel config.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 227 bytes --]