cdh: store ephemeral LUKS headers in tmpfs

When creating ephemeral storages, place the LUKS headers in guest
memory rather than onto the storage device itself.
For this, create LUKS header files in the CDH storage directory,
and call into CryptInit::init_with_data_device instead of into
CryptInit::init.

The code path in which existing, encrypted storages are utilized
remains untouched.

Signed-off-by: Manuel Huber <manuelh@nvidia.com>

Author: manuelh-dev

confidential-data-hub/docs/kms-providers/alibaba.md

@@ -78,7 +78,7 @@ More details about accessing via EcsRamRole can be seen at [Access KMS from an E
 The client `AliyunKmsClient` supports `Encrypter`, `Decrypter`, and `Getter` api. When at the
 user side, the credential files can be directly given by the user.
 
-When in Tee, the credential files is supposed to be placed under `/run/confidential-containers/cdh/kms-credential/aliyun` directory.
+When in Tee, the credential files is supposed to be placed under `/run/confidential-containers/cdh/kbs/kms-credential/aliyun` directory.
 
 ## Sealed Secrets
 

confidential-data-hub/docs/kms-providers/ehsm-kms.md

@@ -39,7 +39,7 @@ For more details please see the [`Enroll` operation of ehsm](https://github.com/
 The client `EhsmKmsClient` supports `Encrypter` and `Decrypter` api. When at the
 user side, the credential files can be directly given by the user.
 
-When in Tee, the credential files is supposed to be placed under `/run/confidential-containers/cdh/kms-credential/ehsm` directory.
+When in Tee, the credential files is supposed to be placed under `/run/confidential-containers/cdh/kbs/kms-credential/ehsm` directory.
 
 ## Sealed Secrets
 

confidential-data-hub/example.config.json

@@ -7,11 +7,11 @@
     },
     "credentials": [
         {
-            "path": "/run/confidential-containers/cdh/kms-credential/aliyun/ecsRamRole.json",
+            "path": "/run/confidential-containers/cdh/kbs/kms-credential/aliyun/ecsRamRole.json",
             "resource_uri": "kbs:///default/aliyun/ecs_ram_role"
         },
         {
-            "path": "/run/confidential-containers/cdh/test/file",
+            "path": "/run/confidential-containers/cdh/kbs/test/file",
             "resource_uri": "kbs:///default/test/file"
         }
     ],

confidential-data-hub/example.config.toml

@@ -53,14 +53,14 @@ oLSG2dLCK9mjjraPjau34Q==
 # credentials are items that will be retrieved from KBS when CDH
 # is launched. `resource_uri` refers to the KBS resource uri and
 # `path` is where to place the file.
-# `path` must be with prefix `/run/confidential-containers/cdh`,
+# `path` must be with prefix `/run/confidential-containers/cdh/kbs`,
 # or it will be blocked by CDH.
 [[credentials]]
-path = "/run/confidential-containers/cdh/kms-credential/aliyun/ecsRamRole.json"
+path = "/run/confidential-containers/cdh/kbs/kms-credential/aliyun/ecsRamRole.json"
 resource_uri = "kbs:///default/aliyun/ecs_ram_role"
 
 [[credentials]]
-path = "/run/confidential-containers/cdh/test/file"
+path = "/run/confidential-containers/cdh/kbs/test/file"
 resource_uri = "kbs:///default/test/file"
 
 [image]

confidential-data-hub/hub/Cargo.toml

@@ -40,6 +40,7 @@ base64.workspace = true
 cfg-if.workspace = true
 clap = { workspace = true, features = ["derive"], optional = true }
 config = { workspace = true }
+const_format.workspace = true
 crypto.path = "../../attestation-agent/deps/crypto"
 env_logger = { workspace = true, optional = true }
 image-rs = { path = "../../image-rs", default-features = false, features = [

confidential-data-hub/hub/src/auth/kbs.rs

@@ -8,15 +8,16 @@
 
 use std::path::PathBuf;
 
+use const_format::concatcp;
 use kms::{plugins::kbs::KbcClient, Annotations, Getter};
 use log::debug;
 use tokio::fs;
 
-use crate::{hub::Hub, Error, Result};
+use crate::{hub::Hub, hub::CDH_BASE_DIR, Error, Result};
 
-/// This directory is used to store all the kbs resources get by CDH's init
-/// function, s.t. `[[Credential]]` sections in the config.toml file.
-pub const KBS_RESOURCE_STORAGE_DIR: &str = "/run/confidential-containers/cdh";
+/// Directory for KBS resources (credentials, etc.) fetched at init, see the `[[credentials]]`
+/// sections in CDH's `config.toml` file, for an example, see `example.config.toml`.
+const KBS_RESOURCE_STORAGE_DIR: &str = concatcp!(CDH_BASE_DIR, "/kbs");
 
 impl Hub {
     pub(crate) async fn init_kbs_resources(&self) -> Result<()> {
@@ -86,11 +87,11 @@ fn is_path_valid(path: &str) -> bool {
 mod tests {
     use rstest::rstest;
 
-    use crate::auth::kbs::{is_path_valid, KBS_RESOURCE_STORAGE_DIR};
+    use super::{is_path_valid, KBS_RESOURCE_STORAGE_DIR};
 
     #[rstest]
     #[case("/etc/config.toml".into(), false)]
-    #[case(format!("{KBS_RESOURCE_STORAGE_DIR}/../../config.toml"), false)]
+    #[case(format!("{KBS_RESOURCE_STORAGE_DIR}/../../config.toml",), false)]
     #[case(format!("{KBS_RESOURCE_STORAGE_DIR}/kms-credential/../../../config.toml"), false)]
     #[case(format!("{KBS_RESOURCE_STORAGE_DIR}/kms-credential/./config.toml"), false)]
     #[case(format!("{KBS_RESOURCE_STORAGE_DIR}/kms-credential/aliyun/config.toml"), true)]

confidential-data-hub/hub/src/config.rs

@@ -142,7 +142,7 @@ impl CdhConfig {
     /// ```
     ///
     /// It is supposed that all the `target path` should be with prefix
-    /// `/run/confidential-containers/cdh` or it will be treated as dangerous
+    /// `/run/confidential-containers/cdh/kbs` or it will be treated as dangerous
     /// path.
     ///
     /// TODO: delete this way after initdata mechanism could cover CDH's launch config.

confidential-data-hub/hub/src/hub.rs

@@ -5,6 +5,9 @@
 
 use std::{collections::HashMap, path::Path};
 
+/// Base directory for CDH runtime data.
+pub(crate) const CDH_BASE_DIR: &str = "/run/confidential-containers/cdh";
+
 use async_trait::async_trait;
 use image_rs::{builder::ClientBuilder, config::ImageConfig, image::ImageClient};
 use kms::{Annotations, ProviderSettings};

confidential-data-hub/hub/src/secret/mod.rs

@@ -7,6 +7,7 @@ pub mod error;
 pub mod layout;
 
 use base64::{engine::general_purpose::URL_SAFE_NO_PAD as b64, Engine};
+use const_format::concatcp;
 use jose_jwa::Signing;
 use jose_jwk::{EcCurves, Jwk};
 use jose_jws::{Flattened, Protected, Unprotected};
@@ -19,9 +20,12 @@ use self::layout::{envelope::EnvelopeSecret, vault::VaultSecret};
 
 use kms::{Annotations, ProviderSettings};
 
+use crate::hub::CDH_BASE_DIR;
+
 pub use error::{Result, SecretError};
 
-pub const SIGNING_CREDENTIALS_PATH: &str = "/run/confidential-containers/cdh/sealed-secret";
+/// Path to the directory containing sealed-secret signing credentials.
+pub const SIGNING_CREDENTIALS_PATH: &str = concatcp!(CDH_BASE_DIR, "/sealed-secret");
 
 #[derive(Serialize, Deserialize, PartialEq, Debug)]
 #[serde(tag = "type", rename_all = "lowercase")]