Hi, On 8/20/25 15:17, Sascha Hauer wrote: > From: Ahmad Fatoum <[email protected]> > > To make it easier to experiment with security policies, add four example > configurations, two via the build system and two "externally".
The configs need a make security_olddefconfig due to the addition of the new symbols in later commits. Cheers, Ahmad > > Signed-off-by: Ahmad Fatoum <[email protected]> > --- > arch/arm/configs/virt32_secure_defconfig | 1 + > common/boards/qemu-virt/Makefile | 3 +++ > common/boards/qemu-virt/board.c | 8 ++++++++ > common/boards/qemu-virt/qemu-virt-factory.sconfig | 24 > ++++++++++++++++++++++ > common/boards/qemu-virt/qemu-virt-lockdown.sconfig | 24 > ++++++++++++++++++++++ > security/qemu-virt-devel.sconfig | 24 > ++++++++++++++++++++++ > security/qemu-virt-tamper.sconfig | 24 > ++++++++++++++++++++++ > 7 files changed, 108 insertions(+) > > diff --git a/arch/arm/configs/virt32_secure_defconfig > b/arch/arm/configs/virt32_secure_defconfig > index > 34cc49405495b33b4f78e078dfbcd951c433fcd8..09c98e5e4dc88aa22b3aa10db38efd7b7cac2310 > 100644 > --- a/arch/arm/configs/virt32_secure_defconfig > +++ b/arch/arm/configs/virt32_secure_defconfig > @@ -292,6 +292,7 @@ CONFIG_FS_UBOOTVARFS=y > CONFIG_SECURITY_POLICY=y > CONFIG_SECURITY_POLICY_INIT="lockdown" > CONFIG_SECURITY_POLICY_DEFAULT_PANIC=y > +CONFIG_SECURITY_POLICY_PATH="security/qemu-virt-devel.sconfig > security/qemu-virt-tamper.sconfig" > CONFIG_BUG_ON_DATA_CORRUPTION=y > CONFIG_DIGEST_SHA1_ARM=y > CONFIG_DIGEST_SHA256_ARM=y > diff --git a/common/boards/qemu-virt/Makefile > b/common/boards/qemu-virt/Makefile > index > 30bf4f1955ee9d306b46523863e247e4cf94ab75..2caa6a20c522ac68fd629f38e51fdf1423db4b09 > 100644 > --- a/common/boards/qemu-virt/Makefile > +++ b/common/boards/qemu-virt/Makefile > @@ -9,5 +9,8 @@ ifeq ($(CONFIG_ARM),y) > DTC_CPP_FLAGS_qemu-virt-flash.dtbo := -DCONFIG_ARM > endif > > +policy-y += qemu-virt-factory.sconfig > +policy-y += qemu-virt-lockdown.sconfig > + > clean-files := *.dtb *.dtb.S .*.dtc .*.pre .*.dts *.dtb.z > clean-files += *.dtbo *.dtbo.S .*.dtso > diff --git a/common/boards/qemu-virt/board.c b/common/boards/qemu-virt/board.c > index > 9882b0c31a3cf9a97ef0e963653c85a3ead961bb..6f88f24b0690c2562b3b3718a56c9f5c46a4455a > 100644 > --- a/common/boards/qemu-virt/board.c > +++ b/common/boards/qemu-virt/board.c > @@ -7,6 +7,7 @@ > #include <init.h> > #include <of.h> > #include <deep-probe.h> > +#include <security/policy.h> > #include "qemu-virt-flash.h" > > #ifdef CONFIG_64BIT > @@ -83,6 +84,13 @@ static int virt_board_driver_init(void) > > /* of_probe() will happen later at of_populate_initcall */ > > + security_policy_add(qemu_virt_factory); > + security_policy_add(qemu_virt_lockdown); > + /* > + * qemu_virt_devel & qemu_virt_tamper intentionally not added here, > + * so the test suite can exercise CONFIG_SECURITY_POLICY_PATH. > + */ > + > return 0; > } > postcore_initcall(virt_board_driver_init); > diff --git a/common/boards/qemu-virt/qemu-virt-factory.sconfig > b/common/boards/qemu-virt/qemu-virt-factory.sconfig > new file mode 100644 > index > 0000000000000000000000000000000000000000..b19d02b37f7c308e8e93da17349981301902d851 > --- /dev/null > +++ b/common/boards/qemu-virt/qemu-virt-factory.sconfig > @@ -0,0 +1,24 @@ > +# > +# Automatically generated file; DO NOT EDIT. > +# Barebox/arm Security Configuration > +# > +SCONFIG_POLICY_NAME="factory" > +SCONFIG_SECURITY_POLICY_SELECT=y > + > +# > +# General Settings > +# > +SCONFIG_RATP=y > +# end of General Settings > + > +# > +# Boot Policy > +# > +# SCONFIG_BOOT_UNSIGNED_IMAGES is not set > +# end of Boot Policy > + > +# > +# Command Policy > +# > +# SCONFIG_CMD_GO is not set > +# end of Command Policy > diff --git a/common/boards/qemu-virt/qemu-virt-lockdown.sconfig > b/common/boards/qemu-virt/qemu-virt-lockdown.sconfig > new file mode 100644 > index > 0000000000000000000000000000000000000000..e11e5e069c61f6b968716b75a836bfda2676057e > --- /dev/null > +++ b/common/boards/qemu-virt/qemu-virt-lockdown.sconfig > @@ -0,0 +1,24 @@ > +# > +# Automatically generated file; DO NOT EDIT. > +# Barebox/arm Security Configuration > +# > +SCONFIG_POLICY_NAME="lockdown" > +SCONFIG_SECURITY_POLICY_SELECT=y > + > +# > +# General Settings > +# > +# SCONFIG_RATP is not set > +# end of General Settings > + > +# > +# Boot Policy > +# > +# SCONFIG_BOOT_UNSIGNED_IMAGES is not set > +# end of Boot Policy > + > +# > +# Command Policy > +# > +# SCONFIG_CMD_GO is not set > +# end of Command Policy > diff --git a/security/qemu-virt-devel.sconfig > b/security/qemu-virt-devel.sconfig > new file mode 100644 > index > 0000000000000000000000000000000000000000..4513917a95cca07d415fcc856589dca92a289707 > --- /dev/null > +++ b/security/qemu-virt-devel.sconfig > @@ -0,0 +1,24 @@ > +# > +# Automatically generated file; DO NOT EDIT. > +# Barebox/arm Security Configuration > +# > +SCONFIG_POLICY_NAME="devel" > +SCONFIG_SECURITY_POLICY_SELECT=y > + > +# > +# General Settings > +# > +SCONFIG_RATP=y > +# end of General Settings > + > +# > +# Boot Policy > +# > +SCONFIG_BOOT_UNSIGNED_IMAGES=y > +# end of Boot Policy > + > +# > +# Command Policy > +# > +SCONFIG_CMD_GO=y > +# end of Command Policy > diff --git a/security/qemu-virt-tamper.sconfig > b/security/qemu-virt-tamper.sconfig > new file mode 100644 > index > 0000000000000000000000000000000000000000..f2453a9936c19fe8a31879d1ee48cd0ce6655d5e > --- /dev/null > +++ b/security/qemu-virt-tamper.sconfig > @@ -0,0 +1,24 @@ > +# > +# Automatically generated file; DO NOT EDIT. > +# Barebox/arm Security Configuration > +# > +SCONFIG_POLICY_NAME="tamper" > +# SCONFIG_SECURITY_POLICY_SELECT is not set > + > +# > +# General Settings > +# > +# SCONFIG_RATP is not set > +# end of General Settings > + > +# > +# Boot Policy > +# > +# SCONFIG_BOOT_UNSIGNED_IMAGES is not set > +# end of Boot Policy > + > +# > +# Command Policy > +# > +# SCONFIG_CMD_GO is not set > +# end of Command Policy > -- Pengutronix e.K. | | Steuerwalder Str. 21 | http://www.pengutronix.de/ | 31137 Hildesheim, Germany | Phone: +49-5121-206917-0 | Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 |
