Secure boot of a virtual machine

A computer-program product for securely booting a virtual machine, the computer-program product comprising a computer-readable storage medium having program instructions embodied therewith, the program instructions executable by a processor to cause the processor to perform a method comprising:

• validating a variable set file for a secure boot, the variable set file comprising one or more variables for the secure boot, the validating the variable set file performed by a hypervisor using a guest public key, and the variable set file signed with a guest private key corresponding to the guest public key;
• validating a secure-boot file configured to securely boot a virtual machine (VM) based at least in part on the variable set file, the validating the secure-boot file performed by the hypervisor using a boot public key, and the secure-boot file signed with a boot private key corresponding to the boot public key;
• and
• executing the secure-boot file to securely boot the VM.

A computer-implemented method comprising:

• starting a hypervisor to boot a first version of a VM, wherein the hypervisor embeds a boot public key;
• validating, by the hypervisor, a secure-boot file configured to securely boot the first version of the VM to extend a secure boot of a host, the validating the secure-boot file performed using the boot public key;
• and
• validating, by the hypervisor, a variable set file useable by the secure-boot file to securely boot the VM, the variable set file comprising one or more variables for securely booting the first version of the VM.

A computer-implemented method comprising:

• providing a secure-boot file in an operating system of a host, the secure-boot file configured to securely boot one or more virtual machines (VMs) to extend a secure boot of the host to the one or more VMs;
• providing one or more variable set files in the operating system, the one or more variable set files useable by the secure-boot file to securely boot the one or more VMs;
• providing a hypervisor public key in a kernel of the host;
• providing, in a hypervisor configured to run a first version of a VM, a boot public key and a guest public key;
• signing the hypervisor with a hypervisor private key corresponding to the hypervisor public key in the kernel;
• signing the secure-boot file of the operating system with a boot private key corresponding to the boot public key of the hypervisor;
• and
• signing a first variable set file, of the one or more variable set files, with a guest private key corresponding to the guest public key of the hypervisor.