Dont set a default for TDX MRSEAM

Signed-off-by: Daniel Weiße <[email protected]>
edgelesssys · Apr 22, 2024 · ab352c2 · ab352c2
1 parent a7451fb
commit ab352c2
Showing 1 changed file with 4 additions and 2 deletions.
diff --git a/internal/config/azure.go b/internal/config/azure.go
@@ -146,8 +146,10 @@ func DefaultForAzureTDX() *AzureTDX {
 		PCESVN:     0,
 		TEETCBSVN:  encoding.HexBytes{0x02, 0x01, 0x06, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00},
 		QEVendorID: encoding.HexBytes{0x93, 0x9a, 0x72, 0x33, 0xf7, 0x9c, 0x4c, 0xa9, 0x94, 0x0a, 0x0d, 0xb3, 0x95, 0x7f, 0x06, 0x07},
-		MRSeam:     encoding.HexBytes{0x36, 0x03, 0x04, 0xd3, 0x4a, 0x16, 0xaa, 0xce, 0x0a, 0x18, 0xe0, 0x9a, 0xd2, 0xd0, 0x7d, 0x2b, 0x9f, 0xd3, 0xc1, 0x74, 0x37, 0x8e, 0x5b, 0xf1, 0x08, 0x38, 0x80, 0x79, 0x82, 0x7f, 0x89, 0xff, 0x62, 0xac, 0xc5, 0xf8, 0xc4, 0x73, 0xdd, 0x40, 0x70, 0x63, 0x24, 0x83, 0x4e, 0x20, 0x29, 0x46},
-		XFAM:       encoding.HexBytes{0xe7, 0x18, 0x06, 0x00, 0x00, 0x00, 0x00, 0x00},
+		// Don't set a default for MRSEAM as it effectively prevents upgrading the SEAM module
+		// Quote verification still makes sure the module comes from Intel (through MRSIGNERSEAM), and is not of a lower version than expected
+		// MRSeam:  nil,
+		XFAM: encoding.HexBytes{0xe7, 0x18, 0x06, 0x00, 0x00, 0x00, 0x00, 0x00},
 
 		IntelRootKey: mustParsePEM(tdxRootPEM),
 	}