[PATCH v2 00/24] Add security policy support
Ahmad Fatoum
a.fatoum at pengutronix.de
Mon Sep 22 09:18:45 PDT 2025
Hello Sascha,
On 17.09.25 15:53, Sascha Hauer wrote:
> Changes in v2:
Thanks for taking over. I have no further comments besides the two I just
sent. I think this is ready to go into next with the two comments addressed.
Cheers,
Ahmad
> - drop security policies for each filesystem. This needs to be reworked.
> A filesystem can safely be mounted when the source is trusted (i.e.
> the fs image is compiled into barebox, or is authorized using upcoming
> dm-verity support) no matter which filesystem type is mounted.
> Therefore just add a policy which selects between "all fs allowed" and
> "no fs allowed except ramfs".
> - fix adding policy-y to non leaf directories
> - remove policy-list files before recreating them to avoid stale entries
> - Drop $(ARCH) string from .sconfig files
> - bail out with a user friendly message when make security_* is invoked
> with security policies being disabled in the config
> - document that policies should always go from restrictive to relaxed,
> not the other way round
> - Link to v1: https://lore.barebox.org/20250820-security-policies-v1-0-76fde70fdbd8@pengutronix.de
>
> Changes in v1:
> - Link to RFC:
> https://lore.kernel.org/all/20250814130702.4039241-1-a.fatoum@pengutronix.de/
> - Add more actual security policies
> - Fix some typos in Documentation
> - Catch invalid policy names in sconfig command
>
> Signed-off-by: Sascha Hauer <s.hauer at pengutronix.de>
> ---
> Ahmad Fatoum (16):
> kconfig: allow setting CONFIG_ from the outside
> scripts: include scripts/include for all host tools
> kbuild: implement loopable loop_cmd
> Add security policy support
> kbuild: allow security config use without source tree modification
> defaultenv: update PS1 according to security policy
> security: policy: support externally provided configs
> docs: security-policies: add documentation
> commands: go: add security config option
> console: ratp: add security config option
> bootm: support calling bootm_optional_signed_images at any time
> bootm: make unsigned image support runtime configurable
> ARM: configs: add virt32_secure_defconfig
> boards: qemu-virt: add security policies
> boards: qemu-virt: allow setting policy from command line
> test: py: add basic security policy test
>
> Sascha Hauer (8):
> commands: implement sconfig command
> usbserial: add inline wrappers
> security: usbgadget: add usbgadget security policy
> security: fastboot: add security policy for fastboot oem
> security: shell: add policy for executing the shell
> security: add security policy for loading barebox environment
> security: add filesystem security policies
> security: console: add security policy for console input
>
> .gitignore | 4 +
> Documentation/devel/devel.rst | 1 +
> Documentation/devel/security-policies.rst | 96 ++++
> Documentation/user/defaultenv-2.rst | 2 +
> Documentation/user/security-policies.rst | 131 +++++
> Documentation/user/user-manual.rst | 1 +
> Makefile | 95 +++-
> Sconfig | 11 +
> arch/arm/configs/virt32_secure_defconfig | 302 ++++++++++++
> commands/Kconfig | 23 +
> commands/Makefile | 1 +
> commands/Sconfig | 12 +
> commands/go.c | 4 +
> commands/sconfig.c | 227 +++++++++
> common/Kconfig | 5 +
> common/Sconfig | 63 +++
> common/boards/qemu-virt/Makefile | 5 +-
> common/boards/qemu-virt/board.c | 11 +
> common/boards/qemu-virt/commandline.c | 74 +++
> common/boards/qemu-virt/commandline.h | 9 +
> common/boards/qemu-virt/qemu-virt-factory.sconfig | 36 ++
> common/boards/qemu-virt/qemu-virt-lockdown.sconfig | 35 ++
> common/bootm.c | 58 ++-
> common/console.c | 11 +-
> common/console_ctrlc.c | 4 +
> common/console_simple.c | 7 +
> common/environment.c | 6 +
> common/fastboot.c | 6 +
> common/hush.c | 13 +
> common/parser.c | 7 +
> common/ratp/ratp.c | 17 +
> common/usbgadget.c | 26 +
> defaultenv/Makefile | 1 +
> .../defaultenv-2-security-policy/bin/ps1-policy | 20 +
> .../defaultenv-2-security-policy/init/ps1-policy | 1 +
> .../init/source-colors | 1 +
> defaultenv/defaultenv.c | 2 +
> drivers/usb/gadget/Sconfig | 11 +
> drivers/usb/gadget/composite.c | 4 +
> drivers/usb/gadget/legacy/serial.c | 4 +
> fs/Sconfig | 5 +
> fs/fs.c | 4 +
> include/linux/usb/usbserial.h | 11 +
> include/security/config.h | 76 +++
> include/security/defs.h | 22 +
> include/security/policy.h | 54 +++
> scripts/Kbuild.include | 41 ++
> scripts/Makefile | 1 -
> scripts/Makefile.build | 18 +-
> scripts/Makefile.lib | 47 ++
> scripts/Makefile.policy | 38 ++
> scripts/Sconfig.include | 6 +
> scripts/basic/.gitignore | 1 +
> scripts/basic/Makefile | 4 +-
> scripts/basic/sconfigpost.c | 540 +++++++++++++++++++++
> scripts/include/list.h | 7 +
> scripts/kconfig/Makefile | 3 +
> scripts/kconfig/list.h | 132 -----
> security/Kconfig | 2 +
> security/Kconfig.policy | 104 ++++
> security/Makefile | 39 ++
> security/Sconfig | 34 ++
> security/policy.c | 239 +++++++++
> security/qemu-virt-devel.sconfig | 36 ++
> security/qemu-virt-tamper.sconfig | 35 ++
> security/sconfig_names.c | 18 +
> test/arm/virt32_secure_defconfig.yaml | 22 +
> test/py/test_policies.py | 48 ++
> 68 files changed, 2778 insertions(+), 156 deletions(-)
> ---
> base-commit: f3be3a8e9ae884bdfb116238e9049b1eb2759810
> change-id: 20250820-security-policies-43f73477d321
>
> Best regards,
--
Pengutronix e.K. | |
Steuerwalder Str. 21 | http://www.pengutronix.de/ |
31137 Hildesheim, Germany | Phone: +49-5121-206917-0 |
Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 |
More information about the barebox
mailing list