LinuxCon + ContainerCon North America 2016

In a hosted environment, fabric administrators have more privileges than domain or workload administrators. The goal of this work is to allow tenants to safely virtualize security-sensitive workloads. This is accomplished using multiple technologies, including: • Trusted Platform Module (TPM)—to seal encryption keys and to support unattended booting. • Measured Boot—to verify boot components. • Disk partition encryption—through LUKS & dm-crypt. This work uses the above technologies to secure the boot chain and the encryption keys to the point where Control is passed to the operating system. This work focuses mainly on virtualized environments, but these principles are applicable in bare metal environments as well.