We have inconsistencies about what verification level is used for FIT images when they are used for both booting and for overlays if bootm -c/-s is used to raise the verification level.
Properly fixing them would increase the complexity, which could in turn negatively impact security. I expect that any users are equally well served with global.bootm.verify, so drop the extra toggle. Signed-off-by: Ahmad Fatoum <[email protected]> --- v1 -> v2: - drop -c from BAREBOX_CMD_OPTS - fix s/verity/verify/ in commit message (Ulrich) --- .../migration-guides/migration-master.rst | 21 +++++++++++++++++++ commands/bootm.c | 13 ++---------- 2 files changed, 23 insertions(+), 11 deletions(-) diff --git a/Documentation/migration-guides/migration-master.rst b/Documentation/migration-guides/migration-master.rst index d5601ac838c5..b40ea66827cb 100644 --- a/Documentation/migration-guides/migration-master.rst +++ b/Documentation/migration-guides/migration-master.rst @@ -12,3 +12,24 @@ OP-TEE loading is now only supported For i.MX6 boards, this can be enabled by enabling ``CONFIG_FIRMWARE_IMX6_OPTEE``. + +Removal of bootm -c/-s options +------------------------------ + +The :ref:`command_bootm` options ``-c`` and ``-s`` used to selectively +enable checksum/hash and signature verification, respectively. + +They have been removed in favor of the global toggle +:ref:`global.bootm.verify <magicvar_global_bootm_verify>`. +This can be restricted at build-time via setting ``CONFIG_BOOTM_FORCE_SIGNED_IMAGES`` +or loosened :ref:`at runtime <use_security-policies>` +via setting ``SCONFIG_BOOT_UNSIGNED_IMAGES``. + +The removal is motivated by making it easier to reason about what the active +verification level is, especially as there are now other uses for verified +images like when :ref:`global.of.overlay.path <magicvar_global_of_overlay_path>` +points at a FIT. + +Existing users, if any, will fail-secure: The command will now exit with a failure:: + + bootm: invalid option -- s diff --git a/commands/bootm.c b/commands/bootm.c index 9ff4b218fd1f..44abb953f661 100644 --- a/commands/bootm.c +++ b/commands/bootm.c @@ -28,7 +28,7 @@ #include <magicvar.h> #include <asm-generic/memory_layout.h> -#define BOOTM_OPTS_COMMON "sca:e:vo:fd" +#define BOOTM_OPTS_COMMON "a:e:vo:fd" #ifdef CONFIG_BOOTM_INITRD #define BOOTM_OPTS BOOTM_OPTS_COMMON "L:r:" @@ -55,13 +55,6 @@ static int do_bootm(int argc, char *argv[]) while ((opt = getopt(argc, argv, BOOTM_OPTS)) > 0) { switch(opt) { - case 'c': - if (data.verify < BOOTM_VERIFY_HASH) - data.verify = BOOTM_VERIFY_HASH; - break; - case 's': - data.verify = BOOTM_VERIFY_SIGNATURE; - break; #ifdef CONFIG_BOOTM_INITRD case 'L': data.initrd_address = simple_strtoul(optarg, NULL, 0); @@ -113,8 +106,6 @@ static int do_bootm(int argc, char *argv[]) BAREBOX_CMD_HELP_START(bootm) BAREBOX_CMD_HELP_TEXT("Options:") -BAREBOX_CMD_HELP_OPT ("-c\t", "hash check image integrity") -BAREBOX_CMD_HELP_OPT ("-s\t", "check signature of image") BAREBOX_CMD_HELP_OPT ("-d\t", "dry run: check data, but do not run") BAREBOX_CMD_HELP_OPT ("-f\t", "load images even if type is undetectable") #ifdef CONFIG_BOOTM_INITRD @@ -134,7 +125,7 @@ BAREBOX_CMD_HELP_END BAREBOX_CMD_START(bootm) .cmd = do_bootm, BAREBOX_CMD_DESC("boot an application image") - BAREBOX_CMD_OPTS("[-cdf" + BAREBOX_CMD_OPTS("[-df" #ifdef CONFIG_BOOTM_INITRD "rL" #endif -- 2.47.3
