Skip to content

Commit

Permalink
AA: avoid creating AAEL if it is disabled
Browse files Browse the repository at this point in the history
Before this commit, if we disabled eventlog recording in AA's config,
there will still be a file `/run/attestation-agent/eventlog` but with no
contents.

This file would be collected by tdx attester, treated as a valid AAEL.
But on CoCo-AS side the AAEL parser will fail because nothing is in it.

This commit will avoid creating this file once we disabled in AA's
config.

Signed-off-by: Xynnn007 <xynnn@linux.alibaba.com>
  • Loading branch information
Xynnn007 committed Aug 16, 2024
1 parent 41ad96d commit 6299736
Showing 1 changed file with 13 additions and 15 deletions.
28 changes: 13 additions & 15 deletions attestation-agent/attestation-agent/src/lib.rs
Original file line number Diff line number Diff line change
Expand Up @@ -79,7 +79,7 @@ pub trait AttestationAPIs {
pub struct AttestationAgent {
config: Config,
attester: BoxedAttester,
eventlog: Mutex<EventLog>,
eventlog: Option<Mutex<EventLog>>,
tee: Tee,
}

Expand All @@ -90,16 +90,15 @@ impl AttestationAgent {
let pcr = self.config.eventlog_config.init_pcr;
let init_entry = LogEntry::Init(alg);
let digest = init_entry.digest_with(alg);
{
// perform atomicly in this block
let mut eventlog = self.eventlog.lock().await;
self.attester
.extend_runtime_measurement(digest, pcr)
.await
.context("write INIT entry")?;
let mut eventlog = EventLog::new()?;
eventlog.write_log(&init_entry).context("write INIT log")?;

self.attester
.extend_runtime_measurement(digest, pcr)
.await
.context("write INIT entry")?;

eventlog.write_log(&init_entry).context("write INIT log")?;
};
self.eventlog = Some(Mutex::new(eventlog));
}

Ok(())
Expand All @@ -120,12 +119,11 @@ impl AttestationAgent {

let tee = detect_tee_type();
let attester: BoxedAttester = tee.try_into()?;
let eventlog = Mutex::new(EventLog::new()?);

Ok(AttestationAgent {
config,
attester,
eventlog,
eventlog: None,
tee,
})
}
Expand Down Expand Up @@ -192,9 +190,9 @@ impl AttestationAPIs for AttestationAgent {
content: &str,
register_index: Option<u64>,
) -> Result<()> {
if !self.config.eventlog_config.enable_eventlog {
let Some(ref eventlog) = self.eventlog else {
bail!("Extend eventlog not enabled when launching!");
}
};

let pcr = register_index.unwrap_or_else(|| {
let pcr = self.config.eventlog_config.init_pcr;
Expand All @@ -213,7 +211,7 @@ impl AttestationAPIs for AttestationAgent {
let digest = log_entry.digest_with(alg);
{
// perform atomicly in this block
let mut eventlog = self.eventlog.lock().await;
let mut eventlog = eventlog.lock().await;
self.attester
.extend_runtime_measurement(digest, pcr)
.await?;
Expand Down

0 comments on commit 6299736

Please sign in to comment.