On Sat, Jun 17, 2023 at 09:58:13PM +0200, Heinrich Schuchardt wrote: > On 6/15/23 10:03, Masahisa Kojima wrote: > > To enforce anti-rollback to any older version, dtb must be > > always update manually. This should be described in the > > documentation. > > > > Signed-off-by: Masahisa Kojima <[email protected]> > > --- > > doc/develop/uefi/uefi.rst | 3 +++ > > 1 file changed, 3 insertions(+) > > > > diff --git a/doc/develop/uefi/uefi.rst b/doc/develop/uefi/uefi.rst > > index ffd13cebe9..d5f8c5f236 100644 > > --- a/doc/develop/uefi/uefi.rst > > +++ b/doc/develop/uefi/uefi.rst > > @@ -552,6 +552,9 @@ update using a capsule file with --fw-version of 5, the > > update will fail. > > When the --fw-version in the capsule file is updated, > > lowest-supported-version > > in the dtb might be updated accordingly. > > > > +If user needs to enroce anti-rollback to any older version, > > +the lowest-supported-version property in dtb must be always updated > > manually. > > Thank you for updating the documentation. > > Allowing to circumvent the rollback protection is a security issue. On a > secure system you would probably want to disable console commands like > mc and fdt. Shouldn't we provide an advice for safe settings?
Is there any case where a user wants to use fdt for some reason, for example, in CONFIG_PREBOOT or CONFIG_BOOTCOMMAND? -Takahiro Akashi > E.g. > > "If a user wanted to enable a rollback to a version forbidden by the > lowest-supported-version property specified in U-Boot's control > device-tree, they could change this property using the fdt command. > Secure systems should not enable this command." > > Best regards > > Heinrich > > > + > > To insert the lowest supported version into a dtb > > > > .. code-block:: console > > > > base-commit: e350d0c60d413d441cbdfa9432ebadb56f625903 >
