On Mon, Sep 09, 2019 at 02:04:50PM +0200, Lukasz Majewski wrote: > Hi Claudius, > > > Hi Lukasz, > > > > On 07/09/2019 00.23, Lukasz Majewski wrote: > > > Hi Claudius, > > > > > >> Hi, > > >> > > >> I am currently looking into variable flags in order to make some > > >> variables read-only for secure boot. > > >> > > >> The idea is that the u-boot binary is signed, while the environment > > >> file/partition is not. So the built-in default environment of > > >> u-boot can be trusted, while the external environment cannot. The > > >> assumption is that those flags can be used to customize the > > >> validation when the external environment is loaded or > > >> scripts/commands are executed. > > >> > > >> From the '/README' I gather that the access attributes can be any > > >> of "any", "read-only", "write-once" or "change-default". > > >> > > >> I first tried to restrict the variables by choosing 'read-only', > > >> but apparently this applies to the internal environment as well, > > >> and now those variables are not loaded from the internal > > >> environment. > > >> > > >> Then I tried 'write-once', this worked now as expected from within > > >> u-boot, but I could modify the environment from the linux userspace > > >> via fw_setenv and those changes appear in u-boot as well. The same > > >> for 'change-default'. > > >> > > >> Is there another way to fill the internal environment variable hash > > >> table, so that 'read-only' works as expected? > > >> > > >> Heiko wrote some patches that change the behavior of the > > >> environment loading so that the internal environment is loaded > > >> first before the external environment. This way 'write-once' > > >> should work as expected, but I think 'read-only' should work that > > >> way already and we are missing something here. > > > > > > I think that Wolfgang had a long discussion with Takahiro AKASHI > > > (both CC'ed) about similar problem with u-boot envs. > > > > Were there any conclusions here? > > I don't know if there was any conclusion (or patches).
No. As a matter of fact, I gave up my idea of modifying flags (attributes) features of U-Boot environment. > > > > For me this 'flags' feature looks more and more like its was not build > > to save guard the loading from unsigned and untrusted external > > environments. I think what we would need here is some sort of variable > > whitelist with some additional checks (type and size), but still allow > > the u-boot scripts and commands to modify the variables in the hash > > table (for filesize, ipaddr etc.) at boot time. > > > Maybe Takahiro could shed some light on his work and you could discuss > if your both work could be aligned? Instead, I'm proposing 'multiple contexts' to be allowed for U-Boot environment[1]. The idea here is that we may have separated backing storage areas, for different variable domains with different needs in U-Boot environment. For example, in my implementation of UEFI variables, one for volatile (non-persistent) variables and another for non-volatile (persistent and auto-saved) variables. (Please note that a context is allowed *not* to have any backing storage.) while I'm not sure yet exactly what Claudius's requirement is, please take a look at my patch below and find out if my work will fit your expectation. [1] https://lists.denx.de/pipermail/u-boot/2019-September/382835.html Thanks, -Takahiro Akashi > > > > > regards, > > Claudius > > > > > > > > For example: > > > https://patchwork.ozlabs.org/patch/1158770/ > > > > > >> > > >> Thanks, > > >> Claudius > > >> > > > > > > > > > > > > Best regards, > > > > > > Lukasz Majewski > > > > > > -- > > > > > > DENX Software Engineering GmbH, Managing Director: Wolfgang > > > Denk HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, > > > Germany Phone: (+49)-8142-66989-59 Fax: (+49)-8142-66989-80 Email: > > > lu...@denx.de > > > > > > Best regards, > > Lukasz Majewski > > -- > > DENX Software Engineering GmbH, Managing Director: Wolfgang Denk > HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany > Phone: (+49)-8142-66989-59 Fax: (+49)-8142-66989-80 Email: lu...@denx.de _______________________________________________ U-Boot mailing list U-Boot@lists.denx.de https://lists.denx.de/listinfo/u-boot