search

edgelesssys / contrast

Deploy and manage confidential containers on Kubernetes
https://docs.edgeless.systems/contrast
GNU Affero General Public License v3.0
183 stars 7 forks source link

manifest: check for empty trusted measurement #616

Closed davidweisse closed 3 months ago

davidweisse commented 3 months ago

Previously, if the TrustedMeasurement field in the manifest was left empty, no error would be produced and the attestation would simply skip the measurement check. The correct way to check for the measurement would be to check if it is empty and not nil. In that case, the value is overridden with 48 zero bytes and the attestation should fail.

katexochen commented 3 months ago

If the trusted measurement is empty but non-nil, does this mean that the user explicitly configured it? Shouldn't we respect that?

Why? To allow the user to disable fundamental security checks?

burgerdev commented 3 months ago

I'd argue that a user who actively resets the measurement in the generated manifest should have the right to do so, but I see your point that this is a footgun with no concrete use case.

davidweisse commented 3 months ago

If the user should not be able to disable the trusted measurement check, then #630 already covers this and we can close this PR.