Move common confidential options for LCOW and WCOW (#2582)

Signed-off-by: Mahati Chamarthy <[email protected]>

Author: MahatiC

internal/oci/uvm.go

@@ -206,7 +206,7 @@ func handleLCOWSecurityPolicy(ctx context.Context, a map[string]string, lopts *u
 		// VPMem not supported by the enlightened kernel for SNP so set count to zero.
 		lopts.VPMemDeviceCount = 0
 		// set the default GuestState filename.
-		lopts.GuestStateFile = uvm.GuestStateFile
+		lopts.GuestStateFilePath = uvm.GuestStateFile
 		lopts.KernelBootOptions = ""
 		lopts.AllowOvercommit = false
 		lopts.SecurityPolicyEnabled = true
@@ -388,7 +388,7 @@ func SpecToUVMCreateOpts(ctx context.Context, s *specs.Spec, id, owner string) (
 		handleLCOWSecurityPolicy(ctx, s.Annotations, lopts)
 
 		// override the default GuestState and DmVerityRootFs filenames if specified
-		lopts.GuestStateFile = ParseAnnotationsString(s.Annotations, annotations.LCOWGuestStateFile, lopts.GuestStateFile)
+		lopts.GuestStateFilePath = ParseAnnotationsString(s.Annotations, annotations.LCOWGuestStateFile, lopts.GuestStateFilePath)
 		lopts.DmVerityRootFsVhd = ParseAnnotationsString(s.Annotations, annotations.DmVerityRootFsVhd, lopts.DmVerityRootFsVhd)
 		lopts.DmVerityMode = ParseAnnotationsBool(ctx, s.Annotations, annotations.DmVerityMode, lopts.DmVerityMode)
 		lopts.DmVerityCreateArgs = ParseAnnotationsString(s.Annotations, annotations.DmVerityCreateArgs, lopts.DmVerityCreateArgs)

internal/tools/uvmboot/lcow.go

@@ -274,7 +274,7 @@ func createLCOWOptions(ctx context.Context, c *cli.Context, id string) (*uvm.Opt
 		options.SecurityPolicyEnforcer = c.String(securityPolicyEnforcerArgName)
 	}
 	if c.IsSet(securityHardwareFlag) {
-		options.GuestStateFile = uvm.GuestStateFile
+		options.GuestStateFilePath = uvm.GuestStateFile
 		options.SecurityPolicyEnabled = true
 		options.AllowOvercommit = false
 	}

internal/uvm/create.go

@@ -131,6 +131,14 @@ type Options struct {
 	ConsolePipe           string // The named pipe path to use for the serial console (COM1).  eg \\.\pipe\vmpipe
 }
 
+type ConfidentialCommonOptions struct {
+	GuestStateFilePath     string // The vmgs file path to load
+	SecurityPolicy         string // Optional security policy
+	SecurityPolicyEnabled  bool   // Set when there is a security policy to apply on actual SNP hardware, use this rathen than checking the string length
+	SecurityPolicyEnforcer string // Set which security policy enforcer to use (open door or rego). This allows for better fallback mechanic.
+	UVMReferenceInfoFile   string // Path to the file that contains the signed UVM measurements
+}
+
 func verifyWCOWBootFiles(bootFiles *WCOWBootFiles) error {
 	if bootFiles == nil {
 		return fmt.Errorf("boot files is nil")
@@ -323,8 +331,8 @@ func (uvm *UtilityVM) CloseCtx(ctx context.Context) (err error) {
 		_ = uvm.WaitCtx(ctx)
 	}
 
-	if lopts, ok := uvm.createOpts.(*OptionsLCOW); ok && uvm.HasConfidentialPolicy() && lopts.GuestStateFile != "" {
-		vmgsFullPath := filepath.Join(lopts.BundleDirectory, lopts.GuestStateFile)
+	if lopts, ok := uvm.createOpts.(*OptionsLCOW); ok && uvm.HasConfidentialPolicy() && lopts.GuestStateFilePath != "" {
+		vmgsFullPath := filepath.Join(lopts.BundleDirectory, lopts.GuestStateFilePath)
 		e := log.G(ctx).WithField("VMGS file", vmgsFullPath)
 		e.Debug("removing VMGS file")
 		if err := os.Remove(vmgsFullPath); err != nil {

internal/uvm/create_lcow.go

@@ -90,16 +90,12 @@ const (
 )
 
 type ConfidentialLCOWOptions struct {
-	GuestStateFile         string // The vmgs file to load
-	UseGuestStateFile      bool   // Use a vmgs file that contains a kernel and initrd, required for SNP
-	SecurityPolicy         string // Optional security policy
-	SecurityPolicyEnabled  bool   // Set when there is a security policy to apply on actual SNP hardware, use this rathen than checking the string length
-	SecurityPolicyEnforcer string // Set which security policy enforcer to use (open door, standard or rego). This allows for better fallback mechanic.
-	UVMReferenceInfoFile   string // Filename under `BootFilesPath` for (potentially signed) UVM image reference information.
-	BundleDirectory        string // pod bundle directory
-	DmVerityRootFsVhd      string // The VHD file (bound to the vmgs file via embedded dmverity hash data file) to load.
-	DmVerityMode           bool   // override to be able to turn off dmverity for debugging
-	DmVerityCreateArgs     string // set dm-verity args when booting with verity in non-SNP mode
+	*ConfidentialCommonOptions
+	UseGuestStateFile  bool   // Use a vmgs file that contains a kernel and initrd, required for SNP
+	BundleDirectory    string // pod bundle directory
+	DmVerityRootFsVhd  string // The VHD file (bound to the vmgs file via embedded dmverity hash data file) to load.
+	DmVerityMode       bool   // override to be able to turn off dmverity for debugging
+	DmVerityCreateArgs string // set dm-verity args when booting with verity in non-SNP mode
 }
 
 // OptionsLCOW are the set of options passed to CreateLCOW() to create a utility vm.
@@ -177,8 +173,10 @@ func NewDefaultOptionsLCOW(id, owner string) *OptionsLCOW {
 		EnableScratchEncryption: false,
 		DisableTimeSyncService:  false,
 		ConfidentialLCOWOptions: &ConfidentialLCOWOptions{
-			SecurityPolicyEnabled: false,
-			UVMReferenceInfoFile:  UVMReferenceInfoFile,
+			ConfidentialCommonOptions: &ConfidentialCommonOptions{
+				SecurityPolicyEnabled: false,
+				UVMReferenceInfoFile:  UVMReferenceInfoFile,
+			},
 		},
 	}
 
@@ -350,7 +348,7 @@ func makeLCOWVMGSDoc(ctx context.Context, opts *OptionsLCOW, uvm *UtilityVM) (_
 	}
 
 	// The kernel and minimal initrd are combined into a single vmgs file.
-	vmgsTemplatePath := filepath.Join(opts.BootFilesPath, opts.GuestStateFile)
+	vmgsTemplatePath := filepath.Join(opts.BootFilesPath, opts.GuestStateFilePath)
 	if _, err := os.Stat(vmgsTemplatePath); os.IsNotExist(err) {
 		return nil, fmt.Errorf("the GuestState vmgs file '%s' was not found", vmgsTemplatePath)
 	}
@@ -367,7 +365,7 @@ func makeLCOWVMGSDoc(ctx context.Context, opts *OptionsLCOW, uvm *UtilityVM) (_
 		return nil, err
 	}
 
-	vmgsFileFullPath := filepath.Join(opts.BundleDirectory, opts.GuestStateFile)
+	vmgsFileFullPath := filepath.Join(opts.BundleDirectory, opts.GuestStateFilePath)
 	if err := copyfile.CopyFile(ctx, vmgsTemplatePath, vmgsFileFullPath, true); err != nil {
 		return nil, fmt.Errorf("failed to copy VMGS template file: %w", err)
 	}

internal/uvm/create_wcow.go

@@ -45,12 +45,7 @@ var (
 )
 
 type ConfidentialWCOWOptions struct {
-	GuestStateFilePath     string // The vmgs file path
-	SecurityPolicyEnabled  bool   // Set when there is a security policy to apply on actual SNP hardware, use this rathen than checking the string length
-	SecurityPolicy         string // Optional security policy
-	SecurityPolicyEnforcer string // Set which security policy enforcer to use (open door or rego). This allows for better fallback mechanic.
-	UVMReferenceInfoFile   string // Path to the file that contains the signed UVM measurements
-
+	*ConfidentialCommonOptions
 	/* Below options are only included for testing/debugging purposes - shouldn't be used in regular scenarios */
 	IsolationType      string
 	DisableSecureBoot  bool
@@ -111,7 +106,9 @@ func NewDefaultOptionsWCOW(id, owner string) *OptionsWCOW {
 		Options:                newDefaultOptions(id, owner),
 		AdditionalRegistryKeys: []hcsschema.RegistryValue{},
 		ConfidentialWCOWOptions: &ConfidentialWCOWOptions{
-			SecurityPolicyEnabled: false,
+			ConfidentialCommonOptions: &ConfidentialCommonOptions{
+				SecurityPolicyEnabled: false,
+			},
 		},
 		OutputHandlerCreator: parseLogrus,
 		ForwardLogs:          true, // Default to true for WCOW, and set to false for CWCOW in internal/oci/uvm.go SpecToUVMCreateOpts