@@ -5,47 +5,135 @@ metadata:
55 namespace : trustee-operator-system
66data :
77 default.rego : |
8- package policy
9- import future.keywords.every
8+ package policy
109
11- default allow = false
10+ import rego.v1
1211
13- allow {
14- every k, v in input {
15- judge_field(k, v)
16- }
12+ # This policy validates multiple TEE platforms
13+ # The policy is meant to capture the TCB requirements
14+ # for confidential containers.
15+
16+ # This policy is used to generate an EAR Appraisal.
17+ # Specifically it generates an AR4SI result.
18+ # More informatino on AR4SI can be found at
19+ # <https://datatracker.ietf.org/doc/draft-ietf-rats-ar4si/>
20+
21+ # For the `executables` trust claim, the value 33 stands for
22+ # "Runtime memory includes executables, scripts, files, and/or
23+ # objects which are not recognized."
24+ default executables := 33
25+
26+ # For the `hardware` trust claim, the value 97 stands for
27+ # "A Verifier does not recognize an Attester's hardware or
28+ # firmware, but it should be recognized."
29+ default hardware := 97
30+
31+ # For the `configuration` trust claim the value 36 stands for
32+ # "Elements of the configuration relevant to security are
33+ # unavailable to the Verifier."
34+ default configuration := 36
35+
36+ ##### Sample
37+
38+ # For the `executables` trust claim, the value 3 stands for
39+ # "Only a recognized genuine set of approved executables have
40+ # been loaded during the boot process."
41+ executables := 3 if {
42+ # The sample attester does not report any launch digest.
43+ # This is an example of how a real platform might validate executables.
44+ input.sample.launch_digest in data.reference.launch_digest
1745 }
1846
19- judge_field(input_key, input_value) {
20- has_key(data.reference, input_key)
21- reference_value := data.reference[input_key]
22- match_value(reference_value, input_value)
47+ # For the `hardware` trust claim, the value 2 stands for
48+ # "An Attester has passed its hardware and/or firmware
49+ # verifications needed to demonstrate that these are genuine/
50+ # supported.
51+ hardware := 2 if {
52+ input.sample.svn in data.reference.svn
2353 }
2454
25- judge_field(input_key, input_value) {
26- not has_key(data.reference, input_key)
55+ ##### SNP
56+ executables := 3 if {
57+ # In the future, we might calculate this measurement here various components
58+ input.snp.measurement in data.reference.snp_launch_measurement
2759 }
2860
29- match_value(reference_value, input_value) {
30- not is_array(reference_value)
31- input_value == reference_value
61+ hardware := 2 if {
62+ # Check the reported TCB to validate the ASP FW
63+ input.snp.reported_tcb_bootloader in data.reference.snp_bootloader
64+ input.snp.reported_tcb_microcode in data.reference.snp_microcode
65+ input.snp.reported_tcb_snp in data.reference.snp_snp_svn
66+ input.snp.reported_tcb_tee in data.reference.snp_tee_svn
3267 }
3368
34- match_value(reference_value, input_value) {
35- is_array(reference_value)
36- array_include(reference_value, input_value)
69+ # For the 'configuration' trust claim 2 stands for
70+ # "The configuration is a known and approved config."
71+ #
72+ # For this, we compare all the configuration fields.
73+ configuration := 2 if {
74+ input.snp.policy_debug_allowed == 0
75+ input.snp.policy_migrate_ma == 0
76+ input.snp.platform_smt_enabled in data.reference.snp_smt_enabled
77+ input.snp.platform_tsme_enabled in data.reference.snp_tsme_enabled
78+ input.snp.policy_abi_major in data.reference.snp_guest_abi_major
79+ input.snp.policy_abi_minor in data.reference.snp_guest_abi_minor
80+ input.snp.policy_single_socket in data.reference.snp_single_socket
81+ input.snp.policy_smt_allowed in data.reference.snp_smt_allowed
3782 }
3883
39- array_include(reference_value_array, input_value) {
40- reference_value_array == []
84+ # For the `configuration` trust claim 3 stands for
85+ # "The configuration includes or exposes no known
86+ # vulnerabilities."
87+ #
88+ # In this check, we do not specifically check every
89+ # configuration value, but we make sure that some key
90+ # configurations (like debug_allowed) are set correctly.
91+ else := 3 if {
92+ input.snp.policy_debug_allowed == 0
93+ input.snp.policy_migrate_ma == 0
4194 }
4295
43- array_include(reference_value_array, input_value) {
44- reference_value_array != []
45- some i
46- reference_value_array[i] == input_value
96+ ##### TDX
97+ executables := 3 if {
98+ # Check the kernel, initrd, and cmdline (including dmverity parameters) measurements
99+ # TODO: add individual CCEL measurements from input.tdx.ccel instead
100+ input.tdx.quote.body.rtmr_1 in data.reference.rtmr_1
101+ input.tdx.quote.body.rtmr_2 in data.reference.rtmr_2
47102 }
48103
49- has_key(m, k) {
50- _ = m[k]
104+ hardware := 2 if {
105+ # Check the quote is a TDX quote signed by Intel SGX Quoting Enclave
106+ input.tdx.quote.header.tee_type == "81000000"
107+ input.tdx.quote.header.vendor_id == "939a7233f79c4ca9940a0db3957f0607"
108+
109+ # Check TDX Module version and its hash. Also check OVMF code hash.
110+ input.tdx.quote.body.mr_seam in data.reference.mr_seam
111+ input.tdx.quote.body.tcb_svn in data.reference.tcb_svn
112+ input.tdx.quote.body.mr_td in data.reference.mr_td
113+ # Check TCB status
114+ # input.tdx.tcb_status == "OK"
115+
116+ # Check collateral expiration status
117+ # input.tdx.collateral_expiration_status == "0"
118+
119+ # Check against allowed advisory ids
120+ # allowed_advisory_ids := {"INTEL-SA-00837"}
121+ # attester_advisory_ids := {id | id := input.attester_advisory_ids[_]}
122+ # object.subset(allowed_advisory_ids, attester_advisory_ids)
123+
124+ # Check against disallowed advisory ids
125+ # disallowed_advisory_ids := {"INTEL-SA-00837"}
126+ # attester_advisory_ids := {id | id := input.tdx.advisory_ids[_]} # convert array to set
127+ # intersection := attester_advisory_ids & disallowed_advisory_ids
128+ # count(intersection) == 0
51129 }
130+
131+ configuration := 2 if {
132+ # Check the TD has the expected attributes (e.g., debug not enabled) and features.
133+ input.tdx.td_attributes.debug == false
134+ input.tdx.quote.body.xfam in data.reference.xfam
135+ }
136+
137+ ##### AZ SNP TODO
138+ ##### AZ TDX TODO
139+ ##### SE TODO
0 commit comments