PowerVM Platform Keystore - Securing Linux Credentials Locally
summary
Proposes a new firmware securityfs kernel layer plus a PowerVM driver that talks to the platform keystore (PKS) via hypervisor HCON calls, exposing authenticated variables (platform key, KPK, kernel and grub key DBs, dbx/dbt, plus proposed trusted CA and module DB) through a single well‑known mount (e.g. /sys/firmware/security). Implements per‑VM encrypted PKS access, file/inode ops (read/write/create) with signature verification and root‑only updates, submits a patch series (Jan 2022) and is implemented but pending upstream acceptance.
AI-written summary · about
chapters (12)
- 0:00Intro
- 3:43How it started?
- 5:16In Parallel - other patches in discussion
- 6:22Existing Interfaces
- 8:30Existing Kernel code structure
- 10:03Environments are different - syntactically and semantically
- 12:04Proposal - Firmware Security Filesystem (fwsecurityfs)
- 13:15securityfs vs fwsecurityfs
- 16:45PowerVM Guest Secure Boot Flow
- 19:28Authenticated Variables Stored in Platform KeyStore
- 22:06PowerVM: Platform Keystore Other Usecases
- 23:59PowerPC Authenticated Variables exposed via fwsecurityfs
related talks
45mDynamic Key Managed PowerPC Guest Secure Boot
33mOpenPOWER: Host OS (Linux Kernel) Secure Boot Key Management
41mProtected Execution Facility
41mUsing the TPM NVRAM to Protect Secure Boot Keys in POWER9 OpenPOWER Systems
30mKernel Hardening With Protection Keys
55mProtected Execution Facility On Power
45mTPMs & The Linux Kernel: Unlocking A Better Path To Hardware Security
41mWhat Is Linux Kernel Keystore and Why You Should Use It in Your Next...