16.7.


重要

  • # grep facilities /proc/cpuinfo | grep 158
    Copy to Clipboard Toggle word wrap

  • # ls /sys/firmware | grep uv
    Copy to Clipboard Toggle word wrap

  • # virsh domcapabilities | grep unpack
    <feature policy='require' name='unpack'/>
    Copy to Clipboard Toggle word wrap

  • # virsh dumpxml <vm_name> | grep "<cpu mode='host-model'/>"
    Copy to Clipboard Toggle word wrap

  • # yum install guestfs-tools
    Copy to Clipboard Toggle word wrap

  1. # grubby --update-kernel=ALL --args="prot_virt=1"
    Copy to Clipboard Toggle word wrap
  2. [...]
        </memballoon>
      </devices>
      <launchSecurity type="s390-pv"/>
    </domain>
    Copy to Clipboard Toggle word wrap

  1. # touch ~/secure-parameters
    Copy to Clipboard Toggle word wrap
  2. # ls /boot/loader/entries -l
    [...]
    -rw-r--r--. 1 root root  281 Oct  9 15:51 3ab27a195c2849429927b00679db15c1-4.18.0-240.el8.s390x.conf
    Copy to Clipboard Toggle word wrap
  3. # cat /boot/loader/entries/3ab27a195c2849429927b00679db15c1-4.18.0-240.el8.s390x.conf | grep options
    options root=/dev/mapper/rhel-root
    crashkernel=auto
    rd.lvm.lv=rhel/root rd.lvm.lv=rhel/swap
    Copy to Clipboard Toggle word wrap
  4. # echo "root=/dev/mapper/rhel-root crashkernel=auto rd.lvm.lv=rhel/root rd.lvm.lv=rhel/swap swiotlb=262144" > ~/secure-parameters
    Copy to Clipboard Toggle word wrap
  5. # genprotimg -i /boot/vmlinuz-4.18.0-240.el8.s390x -r /boot/initramfs-4.18.0-240.el8.s390x.img -p ~/secure-parameters -k HKD-8651-00020089A8.crt -o /boot/secure-image
    Copy to Clipboard Toggle word wrap

  6. # cat /boot/loader/entries/3ab27a195c2849429927b00679db15c1-4.18.0-240.el8.s390x.conf
    title Red Hat Enterprise Linux 8.3
    version 4.18.0-240.el8.s390x
    linux /boot/secure-image
    [...]
    Copy to Clipboard Toggle word wrap
  7. # zipl -V
    Copy to Clipboard Toggle word wrap
  8. # shred /boot/vmlinuz-4.18.0-240.el8.s390x
    # shred /boot/initramfs-4.18.0-240.el8.s390x.img
    # shred secure-parameters
    Copy to Clipboard Toggle word wrap

  1. #!/usr/bin/bash
    
    echo "$(cat /proc/cmdline) swiotlb=262144" > parmfile
    
    cat > ./HKD.crt << EOF
    -----BEGIN CERTIFICATE-----
    1234569901234569901234569901234569901234569901234569901234569900
    1234569901234569901234569901234569901234569901234569901234569900
    1234569901234569901234569901234569901234569901234569901234569900
    1234569901234569901234569901234569901234569901234569901234569900
    1234569901234569901234569901234569901234569901234569901234569900
    1234569901234569901234569901234569901234569901234569901234569900
    1234569901234569901234569901234569901234569901234569901234569900
    1234569901234569901234569901234569901234569901234569901234569900
    1234569901234569901234569901234569901234569901234569901234569900
    1234569901234569901234569901234569901234569901234569901234569900
    1234569901234569901234569901234569901234569901234569901234569900
    1234569901234569901234569901234569901234569901234569901234569900
    1234569901234569901234569901234569901234569901234569901234569900
    1234569901234569901234569901234569901234569901234569901234569900
    1234569901234569901234569901234569901234569901234569901234569900
    1234569901234569901234569901234569901234569901234569901234569900
    1234569901234569901234569901234569901234569901234569901234569900
    1234569901234569901234569901234569901234569901234569901234569900
    1234569901234569901234569901234569901234569901234569901234569900
    1234569901234569901234569901234569901234569901234569901234569900
    1234569901234569901234569901234569901234569901234569901234569900
    1234569901234569901234569901234569901234569901234569901234569900
    1234569901234569901234569901234569901234569901234569901234569900
    1234569901234569901234569901234569901234569901234569901234569900
    1234569901234569901234569901234569901234569901234569901234569900
    xLPRGYwhmXzKDg==
    -----END CERTIFICATE-----
    EOF
    
    version=$(uname -r)
    
    kernel=/boot/vmlinuz-$version
    initrd=/boot/initramfs-$version.img
    
    genprotimg -k ./HKD.crt -p ./parmfile -i $kernel -r $initrd -o /boot/secure-linux --no-verify
    
    cat >> /etc/zipl.conf<< EOF
    
    [secure]
    target=/boot
    image=/boot/secure-linux
    EOF
    
    zipl -V
    
    shutdown -h now
    Copy to Clipboard Toggle word wrap
  2. # virt-customize -a <vm_image_path> --selinux-relabel --firstboot <script_path>
    Copy to Clipboard Toggle word wrap

  • # virsh dumpxml vm-name
    [...]
      <cpu mode='host-model'/>
      <devices>
        <disk type='file' device='disk'>
          <driver name='qemu' type='qcow2' cache='none' io='native'>
          <source file='/var/lib/libvirt/images/secure-guest.qcow2'/>
          <target dev='vda' bus='virtio'/>
        </disk>
        <interface type='network'>
          <source network='default'/>
          <model type='virtio'/>
        </interface>
        <console type='pty'/>
        <memballoon model='none'/>
      </devices>
      <launchSecurity type="s390-pv"/>
    </domain>
    Copy to Clipboard Toggle word wrap
返回顶部
Red Hat logoGithubredditYoutubeTwitter

学习

尝试、购买和销售

社区

关于红帽文档

通过我们的产品和服务,以及可以信赖的内容,帮助红帽用户创新并实现他们的目标。 了解我们当前的更新.

让开源更具包容性

红帽致力于替换我们的代码、文档和 Web 属性中存在问题的语言。欲了解更多详情,请参阅红帽博客.

關於紅帽

我们提供强化的解决方案,使企业能够更轻松地跨平台和环境(从核心数据中心到网络边缘)工作。

Theme

© 2025 Red Hat