github/kata-containers
1
0
Fork 1
mirror of https://github.com/kata-containers/kata-containers.git synced 2025-08-22 17:59:31 +00:00
Code Issues Projects Releases Wiki Activity

runtime-rs: Support initdata within NonProtection scenarios

Browse Source 
we also need support initdat within nonprotection even though the
platform is detected as NonProtection or usually is called nontee
host. Within these cases, there's no need to validate the item of
`confidential_guest=true`, we believe the result of the method
`available_guest_protection()?`.

Signed-off-by: Alex Lyn <alex.lyn@antgroup.com>
This commit is contained in:
Alex Lyn 2025-08-15 14:21:30 +08:00 committed by stevenhorsman
parent c5712cac01
commit 8878534784
1 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/runtime-rs/crates/runtimes/virt_container/src/sandbox.rs
View File

@ -392,10 +392,6 @@ impl VirtSandbox {
hypervisor_config: &HypervisorConfig, hypervisor_config: &HypervisorConfig,
init_data: Option<String>, init_data: Option<String>,
) -> Result<Option<ProtectionDeviceConfig>> { ) -> Result<Option<ProtectionDeviceConfig>> {
if !hypervisor_config.security_info.confidential_guest {
return Ok(None);
}
let available_protection = available_guest_protection()?; let available_protection = available_guest_protection()?;
info!( info!(
sl!(), sl!(),
@ -447,6 +443,7 @@ impl VirtSandbox {
debug: false, debug: false,
}))) })))
}, },
GuestProtection::NoProtection => Ok(None),
_ => Err(anyhow!("confidential_guest requested by configuration but no supported protection available")) _ => Err(anyhow!("confidential_guest requested by configuration but no supported protection available"))
} }
} }
@ -470,6 +467,9 @@ impl VirtSandbox {
GuestProtection::Snp(_details) => { GuestProtection::Snp(_details) => {
calculate_initdata_digest(&initdata, ProtectedPlatform::Snp)? calculate_initdata_digest(&initdata, ProtectedPlatform::Snp)?
} }
GuestProtection::NoProtection => {
calculate_initdata_digest(&initdata, ProtectedPlatform::NoProtection)?
}
// TODO: there's more `GuestProtection` types to be supported. // TODO: there's more `GuestProtection` types to be supported.
_ => return Ok(None), _ => return Ok(None),
}; };