SNPGuard: Remote
Attestation of SEV-SNP VMs
Using Open Source Tools
Luca Wilke, Gianluca Scopelliti
7th Workshop on System Software for Trusted Execution (SysTEX’24)
gianluca.scopelliti@ericsson.com

Disclaimer: This is not a research paper!

2024-07-08 | Page 2 of 30

Ok.. Where do we start?

Recap from previous talkUnmeasured

Measured by TEE

CVM Memory

Root FSOS / applications(mapped rootfs)

Mount & chroot
Execute /sbin/init script

initramfs
initramfs

Execute /init script

KernelLinuxload kernel & initramfs

Firmware
OVMF

2024-07-08 | Page 3 of 30

Problem: Setting up SEV-SNP workflows
is challenging!

2024-07-08 | Page 4 of 30

The SEV-SNP toolchain is currently unstable

Source: https://github.com/AMDESE/AMDSEV/tree/snp-latest
2024-07-08 | Page 5 of 30

Official examples are incomplete or not documented
repository is archived

insecure
not documented
Source: https://github.com/AMDESE/sev-guest
2024-07-08 | Page 6 of 30

Related work either closed source or not standalone
code not available?

SPIRE plugin2024-07-08 | Page 7 of 30

Solution: SNPGuard!

2024-07-08 | Page 8 of 30

Main concepts
Unmeasured
CVM Memory

Root FSOS / applications(mapped rootfs)

initramfs
initramfs

KernelLinuxFirmware
OVMF

2024-07-08 | Page 9 of 30

MeasuredMain concepts
Unmeasured
CVM Memory

OS / applications(mapped rootfs)

Root FS

initramfs
initramfs

KernelLinux

Firmware
OVMF

2024-07-08 | Page 10 of 30

Stable references

MeasuredMain concepts
Unmeasured

Measured

CVM Memory

Root FSOS / applications(mapped rootfs)

initramfs
initramfs
Measure & verify

KernelLinuxFirmware
OVMF

2024-07-08 | Page 11 of 30

1a43b599f2a1

Direct Linux BootMain concepts
Unmeasured

Integrity-protected or
encrypted rootfs

CVM Memory

Root FSOS / applications(mapped rootfs)

Measured

Verify & unlock

Custom initramfs

initramfs
initramfs

Measure & verify

KernelLinux

Firmware
OVMF

2024-07-08 | Page 12 of 30

1a43b599f2a1

Stable references● AMD SEV-SNP toolchain– public forks and “immutable” branches, e.g., “snpguard-stable-6.9”– Multiple install options:● Download pre-built binaries● Build with Docker● Build locally● Attestation library– “virtee/sev” fixed to a specific commit

2024-07-08 | Page 13 of 30

Direct Linux Boot
Unmeasured
CVM Memory

Measured

Load
Modified
OVMF

Firmware2024-07-08 | Page 14 of 30

Dov Murik and Hubertus Franke, “Securing Linux VM boot with AMD SEV measurement,” KVM forum 2021

Direct Linux Boot
Unmeasured

Measured

CVM Memory
initramfs

LinuxKernel params

Measure1a43b599f2a1

Store in firmware
memoryFirmware2024-07-08 | Page 15 of 30

1a43b599f2a1Dov Murik and Hubertus Franke, “Securing Linux VM boot with AMD SEV measurement,” KVM forum 2021

Direct Linux Boot
Unmeasured

Measured

CVM Memory

AMD SP

Compute launchmeasurement

Firmware2024-07-08 | Page 16 of 30

1a43b599f2a1Dov Murik and Hubertus Franke, “Securing Linux VM boot with AMD SEV measurement,” KVM forum 2021

Direct Linux Boot
Unmeasured

Measured

CVM Memory

initramfs
initramfs

KernelLinuxFirmware

2024-07-08 | Page 17 of 30

1a43b599f2a1Dov Murik and Hubertus Franke, “Securing Linux VM boot with AMD SEV measurement,” KVM forum 2021

Direct Linux Boot
Unmeasured

Measured

CVM Memory

initramfs

Measure & verifyKernel

Firmware2024-07-08 | Page 18 of 30

1a43b599f2a1Dov Murik and Hubertus Franke, “Securing Linux VM boot with AMD SEV measurement,” KVM forum 2021

Custom initramfs

ExportBuild & runDockerfile

Docker container

Create archive
initramfs

Filesystem
Add

Init script
2024-07-08 | Page 19 of 30

Binaries

KernelmodulesIntegrity-only workflow

Root FS +hash tree

Root FS
dm-verity script

ffd9c3
Root hash2024-07-08 | Page 20 of 30

https://docs.kernel.org/admin-guide/device-mapper/verity.html

Integrity-only workflow
UnmeasuredMeasured

CVM Memory

Root FS +hash tree

Attested

OS / applications(mapped rootfs)
Verify rootfs integrity

initramfs

2024-07-08 | Page 21 of 30

Kernelffd9c3

Firmware

1a43b599f2a1

Root hash provided ascommand-line parameter

Integrity-only workflow
Unmeasured

Measured

CVM Memory

Root FS +hash tree

Attested

OS / applications(mapped rootfs)
initramfs

2024-07-08 | Page 22 of 30

Kernelffd9c3

Firmware

1a43b599f2a1The entire boot chain is reflectedin the attestation reportIntegrity-only workflow● Flexible attestation (at any time after boot)● Root FS is read-only, but additional partitions can be mounted as r/w (tmpfs)● SSH keys are regenerated in initramfs and stored in encrypted memory2024-07-08 | Page 23 of 30

Encrypted workflow

Root FS

Encrypted FS
dm-crypt script

Key/passphrase

2024-07-08 | Page 24 of 30

dm-integrity is used for
integrity protection

https://docs.kernel.org/admin-guide/device-mapper/dm-crypt.html

Encrypted workflow
Unmeasured

Measured

CVM Memory

Attested

Encrypted FSinitramfs

KernelFirmware2024-07-08 | Page 25 of 30

1a43b599f2a1

Encrypted workflow
Unmeasured

Measured

CVM Memory

Attested

Encrypted FS

initramfs

KernelFirmware2024-07-08 | Page 26 of 30

1a43b599f2a1

Encrypted workflow
Unmeasured

Measured

CVM Memory

Attested

Encrypted FS

initramfs

KernelFirmware2024-07-08 | Page 27 of 30

1a43b599f2a1

Key is wrapped using a sharedsecret established during
attestation

Encrypted workflow
Unmeasured

Measured

CVM Memory

Encrypted FS

Attested

OS / applications(mapped rootfs)
Unlock encrypted rootfs

initramfsKernelFirmware

2024-07-08 | Page 28 of 30

1a43b599f2a1

Encrypted workflow● Attestation must be done at boot time
● Rootfs is r/w● Secrets (e.g., SSH keys) are protected2024-07-08 | Page 29 of 30

SNPGuard: Remote Attestation of SEV-SNP VMs
Using Open Source Tools
github.com/SNPGuard• Stable reference implementation to get started with SEV-SNP– Building blocks can be customized or reused elsewhere• For whom?
– People experimenting / testing– TEE researchers– Everybody who wants to understand the CVM security model• Future work: support vTPM and Intel TDX

Luca Wilke, Gianluca Scopelliti
7th Workshop on System Software for Trusted Execution (SysTEX’24)
gianluca.scopelliti@ericsson.com