Remove direct access to the sealing CDI from the payload
Change the API from offering the raw sealing CDI to offering VM instance
secrets that happend to be derived from the sealing CDI. This makes it
harder for the payload to leak its sealing CDI and losing the ability to
have secrets in the VM.
Bug: 243514248
Test: atest MicrodroidTests
Test: atest ComposHostTestCases
Change-Id: I0e72dabe7daca4d72a35788412d2ee19a3b446a5
diff --git a/tests/aidl/com/android/microdroid/testservice/ITestService.aidl b/tests/aidl/com/android/microdroid/testservice/ITestService.aidl
index 0913fe3..ebb2bcf 100644
--- a/tests/aidl/com/android/microdroid/testservice/ITestService.aidl
+++ b/tests/aidl/com/android/microdroid/testservice/ITestService.aidl
@@ -25,8 +25,8 @@
/* read a system property. */
String readProperty(String prop);
- /* get the VM's stable secret, this is _only_ done for testing. */
- byte[] insecurelyExposeSealingCdi();
+ /* get a VM instance secret, this is _only_ done for testing. */
+ byte[] insecurelyExposeVmInstanceSecret();
/* get the VM's attestation secret, this is _only_ done for testing. */
byte[] insecurelyExposeAttestationCdi();
diff --git a/tests/testapk/src/java/com/android/microdroid/test/MicrodroidTests.java b/tests/testapk/src/java/com/android/microdroid/test/MicrodroidTests.java
index 4b40293..54a2587 100644
--- a/tests/testapk/src/java/com/android/microdroid/test/MicrodroidTests.java
+++ b/tests/testapk/src/java/com/android/microdroid/test/MicrodroidTests.java
@@ -231,7 +231,7 @@
private class VmCdis {
public byte[] cdiAttest;
- public byte[] cdiSeal;
+ public byte[] instanceSecret;
}
private VmCdis launchVmAndGetCdis(String instanceName)
@@ -247,7 +247,7 @@
ITestService testService = ITestService.Stub.asInterface(
vm.connectToVsockServer(ITestService.SERVICE_PORT).get());
vmCdis.cdiAttest = testService.insecurelyExposeAttestationCdi();
- vmCdis.cdiSeal = testService.insecurelyExposeSealingCdi();
+ vmCdis.instanceSecret = testService.insecurelyExposeVmInstanceSecret();
forceStop(vm);
} catch (Exception e) {
exception.complete(e);
@@ -281,10 +281,9 @@
assertThat(vm_a_cdis.cdiAttest).isNotNull();
assertThat(vm_b_cdis.cdiAttest).isNotNull();
assertThat(vm_a_cdis.cdiAttest).isNotEqualTo(vm_b_cdis.cdiAttest);
- assertThat(vm_a_cdis.cdiSeal).isNotNull();
- assertThat(vm_b_cdis.cdiSeal).isNotNull();
- assertThat(vm_a_cdis.cdiSeal).isNotEqualTo(vm_b_cdis.cdiSeal);
- assertThat(vm_a_cdis.cdiAttest).isNotEqualTo(vm_b_cdis.cdiSeal);
+ assertThat(vm_a_cdis.instanceSecret).isNotNull();
+ assertThat(vm_b_cdis.instanceSecret).isNotNull();
+ assertThat(vm_a_cdis.instanceSecret).isNotEqualTo(vm_b_cdis.instanceSecret);
}
@Test
@@ -307,9 +306,9 @@
VmCdis first_boot_cdis = launchVmAndGetCdis("test_vm");
VmCdis second_boot_cdis = launchVmAndGetCdis("test_vm");
// The attestation CDI isn't specified to be stable, though it might be
- assertThat(first_boot_cdis.cdiSeal).isNotNull();
- assertThat(second_boot_cdis.cdiSeal).isNotNull();
- assertThat(first_boot_cdis.cdiSeal).isEqualTo(second_boot_cdis.cdiSeal);
+ assertThat(first_boot_cdis.instanceSecret).isNotNull();
+ assertThat(second_boot_cdis.instanceSecret).isNotNull();
+ assertThat(first_boot_cdis.instanceSecret).isEqualTo(second_boot_cdis.instanceSecret);
}
@Test
diff --git a/tests/testapk/src/native/testbinary.cpp b/tests/testapk/src/native/testbinary.cpp
index d1cfc56..85cbd97 100644
--- a/tests/testapk/src/native/testbinary.cpp
+++ b/tests/testapk/src/native/testbinary.cpp
@@ -73,14 +73,14 @@
return ndk::ScopedAStatus::ok();
}
- ndk::ScopedAStatus insecurelyExposeSealingCdi(std::vector<uint8_t>* out) override {
- uint8_t cdi[64];
- size_t cdi_size = get_dice_sealing_cdi(cdi, sizeof(cdi));
- if (cdi_size == 0) {
+ ndk::ScopedAStatus insecurelyExposeVmInstanceSecret(std::vector<uint8_t>* out) override {
+ const uint8_t identifier[] = {1, 2, 3, 4};
+ uint8_t secret[32];
+ if (!get_vm_instance_secret(identifier, sizeof(identifier), secret, sizeof(secret))) {
return ndk::ScopedAStatus::
- fromServiceSpecificErrorWithMessage(0, "Failed to get sealing cdi");
+ fromServiceSpecificErrorWithMessage(0, "Failed to VM instance secret");
}
- *out = {cdi, cdi + cdi_size};
+ *out = {secret, secret + sizeof(secret)};
return ndk::ScopedAStatus::ok();
}