On 6/15/23 10:03, Masahisa Kojima wrote:
To enforce anti-rollback to any older version, dtb must be
always update manually. This should be described in the
documentation.
Signed-off-by: Masahisa Kojima <[email protected]>
---
doc/develop/uefi/uefi.rst | 3 +++
1 file changed, 3 insertions(+)
diff --git a/doc/develop/uefi/uefi.rst b/doc/develop/uefi/uefi.rst
index ffd13cebe9..d5f8c5f236 100644
--- a/doc/develop/uefi/uefi.rst
+++ b/doc/develop/uefi/uefi.rst
@@ -552,6 +552,9 @@ update using a capsule file with --fw-version of 5, the
update will fail.
When the --fw-version in the capsule file is updated, lowest-supported-version
in the dtb might be updated accordingly.
+If user needs to enroce anti-rollback to any older version,
+the lowest-supported-version property in dtb must be always updated manually.
Thank you for updating the documentation.
Allowing to circumvent the rollback protection is a security issue. On a
secure system you would probably want to disable console commands like
mc and fdt. Shouldn't we provide an advice for safe settings?
E.g.
"If a user wanted to enable a rollback to a version forbidden by the
lowest-supported-version property specified in U-Boot's control
device-tree, they could change this property using the fdt command.
Secure systems should not enable this command."
Best regards
Heinrich
+
To insert the lowest supported version into a dtb
.. code-block:: console
base-commit: e350d0c60d413d441cbdfa9432ebadb56f625903
