product_policy/
sivm.rs

1// Copyright (c) Microsoft Corporation.
2// Licensed under the MIT License.
3
4//! Sivm policy body and validation methods. Accessor
5//! `MeasuredProductPolicy::sivm` is generated by `define_product_policy!`
6//! in `lib.rs`.
7
8extern crate alloc;
9
10use alloc::vec::Vec;
11
12use crate::uefi_security_policy::UefiSecurityPolicy;
13
14/// Sivm policy body.
15#[derive(mesh_protobuf::Protobuf, Debug, Clone, PartialEq, Default)]
16#[cfg_attr(feature = "manifest", derive(serde::Serialize, serde::Deserialize))]
17#[cfg_attr(
18    feature = "manifest",
19    serde(rename_all = "snake_case", deny_unknown_fields)
20)]
21#[cfg_attr(feature = "inspect", derive(inspect::Inspect))]
22#[mesh(package = "openhcl.product_policy")]
23pub struct SivmPolicy {
24    /// Reserved: require an ephemeral VMGS. Not enforced at runtime yet.
25    #[mesh(1)]
26    pub require_ephemeral_vmgs: bool,
27
28    /// Require secure boot is enabled.
29    #[mesh(2)]
30    pub require_secure_boot: bool,
31
32    /// Reserved: require PK/KEK/db/dbx variables. Not enforced at runtime yet.
33    #[mesh(3)]
34    pub require_secure_boot_vars: bool,
35
36    /// Reserved: require `BootConfigurationDataHash`. Not enforced at runtime yet.
37    #[mesh(4)]
38    pub require_bcd_integrity: bool,
39
40    /// Custom UEFI JSON bytes (base64 in manifest JSON). Required in
41    /// manifests and asserted non-empty at build time when secure boot
42    /// plus secure-boot-vars or BCD-integrity are set;
43    #[mesh(5)]
44    #[cfg_attr(
45        feature = "manifest",
46        serde(with = "super::product_policy_helpers::custom_uefi_json_serde")
47    )]
48    #[cfg_attr(feature = "inspect", inspect(with = "Vec::<u8>::len"))]
49    pub custom_uefi_json: Vec<u8>,
50}
51
52impl crate::uefi_security_policy::UefiSecurityPolicyParams for SivmPolicy {
53    fn require_secure_boot(&self) -> bool {
54        self.require_secure_boot
55    }
56}
57
58impl UefiSecurityPolicy for SivmPolicy {}
product_policy/sivm.rs

product_policy/
sivm.rs
