src/security/policy/zxcrypt/BUILD.gn

# Copyright 2020 The Fuchsia Authors. All rights reserved.
# Use of this source code is governed by a BSD-style license that can be
# found in the LICENSE file.

import("//build/dist/generated_resource.gni")

# The various targets in this file represent zxcrypt configuration files added
# to the boot partition of ZBI files as `config/zxcrypt`, for consumption by
# fshost and the paver, respectively.
#
# The configuration file specifies from where the system should obtain the
# zxcrypt master key to the system data partition.

# The device should use an all-0's master key, as we lack support for any
# secure on-device storage.
generated_resource("null") {
  outputs = [ "config/zxcrypt" ]
  contents = "null"
}

# The device is required to have a Trusted Execution Environment (TEE) which
# includes the "keysafe" Trusted Application (associated with the KMS service).
# The zxcrypt master key should be derived from a per-device key accessible
# only to trusted apps running in the TEE.
generated_resource("tee") {
  outputs = [ "config/zxcrypt" ]
  contents = "tee"
}

# The device will attempt to use keys from the TEE if available, but will fall
# back to using the null key if the key from the TEE does not work, or if the
# TEE is not functional on this device.
generated_resource("tee-opportunistic") {
  outputs = [ "config/zxcrypt" ]
  contents = "tee-opportunistic"
}

# The device will require the use of a key from the TEE for new volume
# creation, but will continue to try both a TEE-sourced key and the null key
# when unsealing volumes.
generated_resource("tee-transitional") {
  outputs = [ "config/zxcrypt" ]
  contents = "tee-transitional"
}