report

Documentation

Overview

Package report provides an API to the configfs/tsm/report subsystem for collecting attestation reports and associated certificates.

Index

• type GenerationErr
  • func GetGenerationErr(err error) *GenerationErr
  • func (e *GenerationErr) Error() string
• type OpenReport
  • func Create(client configfsi.Client, req *Request) (*OpenReport, error)
  • func CreateOpenReport(client configfsi.Client) (*OpenReport, error)
  • func UnsafeWrap(client configfsi.Client, entryPath string) (r *OpenReport, err error)
  • func (r *OpenReport) Destroy() error
  • func (r *OpenReport) Get() (*Response, error)
  • func (r *OpenReport) PrivilegeLevelFloor() (uint, error)
  • func (r *OpenReport) ReadOption(subtree string) ([]byte, error)
  • func (r *OpenReport) WriteOption(subtree string, data []byte) error
• type Privilege
• type Request
• type Response
  • func Get(client configfsi.Client, req *Request) (*Response, error)

Types

type GenerationErr

type GenerationErr struct {
	Got       uint64
	Want      uint64
	Attribute string
}

GenerationErr is returned when an attribute's value is invalid due to mismatched expectations on the number of writes to a report entry.

func GetGenerationErr

func GetGenerationErr(err error) *GenerationErr

GetGenerationErr returns the GenerationErr contained in an error with 0 or 1 wraps.

func (*GenerationErr) Error

func (e *GenerationErr) Error() string

Error returns the human-readable explanation for the error.

type OpenReport

type OpenReport struct {
	InBlob     []byte
	Privilege  *Privilege
	GetAuxBlob bool
	// contains filtered or unexported fields
}

OpenReport represents a created tsm report subtree with internal expectations for the generation.

func Create

func Create(client configfsi.Client, req *Request) (*OpenReport, error)

Create returns a newly-created entry in the configfs-tsm report subtree with common inputs for the Get() method initialized from the request.

func CreateOpenReport

func CreateOpenReport(client configfsi.Client) (*OpenReport, error)

CreateOpenReport returns a newly-created entry in the configfs-tsm report subtree with an initial expected generation value.

func UnsafeWrap

func UnsafeWrap(client configfsi.Client, entryPath string) (r *OpenReport, err error)

UnsafeWrap returns a new OpenReport for a given report entry.

func (*OpenReport) Destroy

func (r *OpenReport) Destroy() error

Destroy returns an error if the configfs report subtree cannot be removed. Will not error for partially initialized or already-destroyed reports.

func (*OpenReport) Get

func (r *OpenReport) Get() (*Response, error)

Get returns the requested report data after initializing the context to the expected parameters. Returns an error if the kernel reports an error or there is a difference in expected generation value.

func (*OpenReport) PrivilegeLevelFloor

func (r *OpenReport) PrivilegeLevelFloor() (uint, error)

PrivilegeLevelFloor returns the privlevel_floor attribute interpreted as the uint type it is.

func (*OpenReport) ReadOption

func (r *OpenReport) ReadOption(subtree string) ([]byte, error)

ReadOption is a safe accessor to a readable attribute of a report. Returns an error if there is any detected tampering to the ongoing request.

func (*OpenReport) WriteOption

func (r *OpenReport) WriteOption(subtree string, data []byte) error

WriteOption sets a configfs report option to the provided data and internally tracks the generation that should be expected on the next ReadOption.

type Privilege

type Privilege struct {
	Level uint
}

Privilege represents the requested privilege information at which a report should be created.

type Request

type Request struct {
	InBlob     []byte
	Privilege  *Privilege
	GetAuxBlob bool
}

Request represents an open request for an attestation report.

type Response

type Response struct {
	Provider string
	OutBlob  []byte
	AuxBlob  []byte
}

Response represents a common case response for getting at attestation report to avoid multiple attribute access calls.

func Get

func Get(client configfsi.Client, req *Request) (*Response, error)

Get returns a one-shot configfs-tsm report given a report request.