rottweiler: dynamically exclude settings from settings.measurement.excluded-settings

[ginglis13]

Issue number:

Related: bottlerocket-os/bottlerocket#4872

Description of changes:

When measuring OS settings into PCR 8, rottweiler now reads settings.measurement.excluded-settings and appends them as additional --exclude arguments to apiclient.

Testing done:

In combination with bottlerocket-os/bottlerocket-settings-sdk#140

Test Matrix

Test Case	User Data Config	Purpose
Baseline	No settings.measurement	Control
Excluded	excluded-settings = ["host-containers"]	Verify exclusion works
Disallowed	excluded-settings = ["settings", "*", "settings.measurement", "host-containers"]	Verify disallowed patterns are rejected

Results

PCR 8 Values

Test Case	PCR 8 (sha256)
Baseline	B1ED3892838081122EB1ECBACE7C8225041B9D5CE9F24A1D4556713285B3B752
Excluded	A94FE2DA15EFA2DB5C120B2A9DBCF4632E1B92446B858CD7CD1A30DC59643FB0
Disallowed	<failure to boot, bad settings provided>

Key observation: All three PCR 8 values are different, confirming that the exclusion configuration affects the measurement.

Test Case 1: Baseline (No Exclusions)

User data:

[settings.host-containers.admin]
enabled = true
source = "328549459982.dkr.ecr.us-west-2.amazonaws.com/bottlerocket-admin:v0.11.16"

Settings keys present: autoscaling, aws, boot, cloudformation, ecs, host-containers, kernel, metrics, motd, network, ntp, oci-defaults, oci-hooks, updates

Observations:

• host-containers is present in settings (containing admin container config)
• measurement is not present (setting was not configured)
• PCR 8 was measured from ALL settings (minus hardcoded exclusions: updates.seed, network.hostname)

✅ Baseline works as expected with no exclusions.

Test Case 2: With Exclusion (host-containers)

User data:

[settings.host-containers.admin]
enabled = true
source = "328549459982.dkr.ecr.us-west-2.amazonaws.com/bottlerocket-admin:v0.11.16"

[settings.measurement]
excluded-settings = ["host-containers"]

Settings keys present: autoscaling, aws, boot, cloudformation, ecs, host-containers, kernel, measurement, metrics, motd, network, ntp, oci-defaults, oci-hooks, updates

Measurement settings value:

{
  "excluded-settings": ["host-containers"]
}

Observations:

• PCR 8 (A94F...) differs from baseline (B1ED...): exclusion changed the measurement
• host-containers is still present in settings (the setting exists, just excluded from measurement)
• measurement is now present in settings and is measured (not self-excluded)
• The difference in PCR 8 between baseline and this case is due to:
  1. host-containers being excluded from the measured payload
  2. settings.measurement being ADDED to the measured payload (it didn't exist in baseline)

✅ Exclusion of host-containers from PCR 8 measurement is working correctly.

Test Case 3: Disallowed Values

User data:

[settings.host-containers.admin]
enabled = true
source = "328549459982.dkr.ecr.us-west-2.amazonaws.com/bottlerocket-admin:v0.11.16"

[settings.measurement]
excluded-settings = ["settings", "*", "settings.measurement", "host-containers"]

Instance boot fails.

Check	Expected	Actual	Status
Baseline PCR 8 != Excluded PCR 8	Different values	B1ED... != A94F...	PASS
Baseline PCR 8 != Disallowed PCR 8	Different values	B1ED... != 0DCC...	PASS
Excluded PCR 8 != Disallowed PCR 8	Different (different measurement content)	A94F... != 0DCC...	PASS
host-containers present in API on all instances	True	True on all 3	PASS
settings.measurement present when configured	True	True on excluded + disallowed	PASS
Disallowed values passed to API	Failure to boot	Failure to boot	PASS
settings.measurement not self-excluded	Contributes to PCR	Different PCR when content differs	PASS

Terms of contribution:

By submitting this pull request, I agree that this contribution is dual-licensed under the terms of both the Apache License, version 2.0, and the MIT license.

[piyush-jena]

Based on yesterday's changes, TC3 should error out, right? Because of wildcards and "settings"?

[ginglis13]

Based on yesterday's changes, TC3 should error out, right? Because of wildcards and "settings"?

Correct, will update the PR description