Re: [PATCH 15/24] boards: qemu-virt: add security policies

2025-08-21 Thread Ahmad Fatoum 
Hi,

On 8/21/25 16:15, Sascha Hauer wrote:
> On Thu, Aug 21, 2025 at 08:57:10AM +0200, Ahmad Fatoum wrote:
>> Hi,
>>
>> On 8/20/25 15:17, Sascha Hauer wrote:
>>> From: Ahmad Fatoum 
>>>
>>> To make it easier to experiment with security policies, add four example
>>> configurations, two via the build system and two "externally".
>>
>> The configs need a make security_olddefconfig due to the addition of the
>> new symbols in later commits.
> 
> Indeed.
> 
> One thing I just noticed is that the qemu-virt board is built for both
> 32bit and 64bit boards. The sconfig files are currently suitable for the
> 32bit variant, but enabling security policies in multi_v8_defconfig
> results in a
> 
> Security policy qemu-virt-lockdown.sconfig.tmp was not up to date.
> 
> This is not a problem since security policies are only enabled in
> virt32_secure_defconfig, but nevertheless that's something we might want
> to improve somehow.

You can get the same message too in multi_v7_defconfig if we start
configuring things differently to virt32_secure_defconfig..

There's potential for future improvement for sure, yes.

Cheers,
Ahmad

> 
> Sascha
> 

-- 
Pengutronix e.K.  | |
Steuerwalder Str. 21  | http://www.pengutronix.de/  |
31137 Hildesheim, Germany | Phone: +49-5121-206917-0|
Amtsgericht Hildesheim, HRA 2686  | Fax:   +49-5121-206917- |

Re: [PATCH 15/24] boards: qemu-virt: add security policies

2025-08-21 Thread Sascha Hauer 
On Thu, Aug 21, 2025 at 08:57:10AM +0200, Ahmad Fatoum wrote:
> Hi,
> 
> On 8/20/25 15:17, Sascha Hauer wrote:
> > From: Ahmad Fatoum 
> > 
> > To make it easier to experiment with security policies, add four example
> > configurations, two via the build system and two "externally".
> 
> The configs need a make security_olddefconfig due to the addition of the
> new symbols in later commits.

Indeed.

One thing I just noticed is that the qemu-virt board is built for both
32bit and 64bit boards. The sconfig files are currently suitable for the
32bit variant, but enabling security policies in multi_v8_defconfig
results in a

Security policy qemu-virt-lockdown.sconfig.tmp was not up to date.

This is not a problem since security policies are only enabled in
virt32_secure_defconfig, but nevertheless that's something we might want
to improve somehow.

Sascha

-- 
Pengutronix e.K.   | |
Steuerwalder Str. 21   | http://www.pengutronix.de/  |
31137 Hildesheim, Germany  | Phone: +49-5121-206917-0|
Amtsgericht Hildesheim, HRA 2686   | Fax:   +49-5121-206917- |

Re: [PATCH 15/24] boards: qemu-virt: add security policies

2025-08-21 Thread Ahmad Fatoum 
Hi,

On 8/20/25 15:17, Sascha Hauer wrote:
> From: Ahmad Fatoum 
> 
> To make it easier to experiment with security policies, add four example
> configurations, two via the build system and two "externally".

The configs need a make security_olddefconfig due to the addition of the
new symbols in later commits.

Cheers,
Ahmad

> 
> Signed-off-by: Ahmad Fatoum 
> ---
>  arch/arm/configs/virt32_secure_defconfig   |  1 +
>  common/boards/qemu-virt/Makefile   |  3 +++
>  common/boards/qemu-virt/board.c|  8 
>  common/boards/qemu-virt/qemu-virt-factory.sconfig  | 24 
> ++
>  common/boards/qemu-virt/qemu-virt-lockdown.sconfig | 24 
> ++
>  security/qemu-virt-devel.sconfig   | 24 
> ++
>  security/qemu-virt-tamper.sconfig  | 24 
> ++
>  7 files changed, 108 insertions(+)
> 
> diff --git a/arch/arm/configs/virt32_secure_defconfig 
> b/arch/arm/configs/virt32_secure_defconfig
> index 
> 34cc49405495b33b4f78e078dfbcd951c433fcd8..09c98e5e4dc88aa22b3aa10db38efd7b7cac2310
>  100644
> --- a/arch/arm/configs/virt32_secure_defconfig
> +++ b/arch/arm/configs/virt32_secure_defconfig
> @@ -292,6 +292,7 @@ CONFIG_FS_UBOOTVARFS=y
>  CONFIG_SECURITY_POLICY=y
>  CONFIG_SECURITY_POLICY_INIT="lockdown"
>  CONFIG_SECURITY_POLICY_DEFAULT_PANIC=y
> +CONFIG_SECURITY_POLICY_PATH="security/qemu-virt-devel.sconfig 
> security/qemu-virt-tamper.sconfig"
>  CONFIG_BUG_ON_DATA_CORRUPTION=y
>  CONFIG_DIGEST_SHA1_ARM=y
>  CONFIG_DIGEST_SHA256_ARM=y
> diff --git a/common/boards/qemu-virt/Makefile 
> b/common/boards/qemu-virt/Makefile
> index 
> 30bf4f1955ee9d306b46523863e247e4cf94ab75..2caa6a20c522ac68fd629f38e51fdf1423db4b09
>  100644
> --- a/common/boards/qemu-virt/Makefile
> +++ b/common/boards/qemu-virt/Makefile
> @@ -9,5 +9,8 @@ ifeq ($(CONFIG_ARM),y)
>  DTC_CPP_FLAGS_qemu-virt-flash.dtbo := -DCONFIG_ARM
>  endif
>  
> +policy-y += qemu-virt-factory.sconfig
> +policy-y += qemu-virt-lockdown.sconfig
> +
>  clean-files := *.dtb *.dtb.S .*.dtc .*.pre .*.dts *.dtb.z
>  clean-files += *.dtbo *.dtbo.S .*.dtso
> diff --git a/common/boards/qemu-virt/board.c b/common/boards/qemu-virt/board.c
> index 
> 9882b0c31a3cf9a97ef0e963653c85a3ead961bb..6f88f24b0690c2562b3b3718a56c9f5c46a4455a
>  100644
> --- a/common/boards/qemu-virt/board.c
> +++ b/common/boards/qemu-virt/board.c
> @@ -7,6 +7,7 @@
>  #include 
>  #include 
>  #include 
> +#include 
>  #include "qemu-virt-flash.h"
>  
>  #ifdef CONFIG_64BIT
> @@ -83,6 +84,13 @@ static int virt_board_driver_init(void)
>  
>   /* of_probe() will happen later at of_populate_initcall */
>  
> + security_policy_add(qemu_virt_factory);
> + security_policy_add(qemu_virt_lockdown);
> + /*
> +  * qemu_virt_devel & qemu_virt_tamper intentionally not added here,
> +  * so the test suite can exercise CONFIG_SECURITY_POLICY_PATH.
> +  */
> +
>   return 0;
>  }
>  postcore_initcall(virt_board_driver_init);
> diff --git a/common/boards/qemu-virt/qemu-virt-factory.sconfig 
> b/common/boards/qemu-virt/qemu-virt-factory.sconfig
> new file mode 100644
> index 
> ..b19d02b37f7c308e8e93da17349981301902d851
> --- /dev/null
> +++ b/common/boards/qemu-virt/qemu-virt-factory.sconfig
> @@ -0,0 +1,24 @@
> +#
> +# Automatically generated file; DO NOT EDIT.
> +# Barebox/arm Security Configuration
> +#
> +SCONFIG_POLICY_NAME="factory"
> +SCONFIG_SECURITY_POLICY_SELECT=y
> +
> +#
> +# General Settings
> +#
> +SCONFIG_RATP=y
> +# end of General Settings
> +
> +#
> +# Boot Policy
> +#
> +# SCONFIG_BOOT_UNSIGNED_IMAGES is not set
> +# end of Boot Policy
> +
> +#
> +# Command Policy
> +#
> +# SCONFIG_CMD_GO is not set
> +# end of Command Policy
> diff --git a/common/boards/qemu-virt/qemu-virt-lockdown.sconfig 
> b/common/boards/qemu-virt/qemu-virt-lockdown.sconfig
> new file mode 100644
> index 
> ..e11e5e069c61f6b968716b75a836bfda2676057e
> --- /dev/null
> +++ b/common/boards/qemu-virt/qemu-virt-lockdown.sconfig
> @@ -0,0 +1,24 @@
> +#
> +# Automatically generated file; DO NOT EDIT.
> +# Barebox/arm Security Configuration
> +#
> +SCONFIG_POLICY_NAME="lockdown"
> +SCONFIG_SECURITY_POLICY_SELECT=y
> +
> +#
> +# General Settings
> +#
> +# SCONFIG_RATP is not set
> +# end of General Settings
> +
> +#
> +# Boot Policy
> +#
> +# SCONFIG_BOOT_UNSIGNED_IMAGES is not set
> +# end of Boot Policy
> +
> +#
> +# Command Policy
> +#
> +# SCONFIG_CMD_GO is not set
> +# end of Command Policy
> diff --git a/security/qemu-virt-devel.sconfig 
> b/security/qemu-virt-devel.sconfig
> new file mode 100644
> index 
> ..4513917a95cca07d415fcc856589dca92a289707
> --- /dev/null
> +++ b/security/qemu-virt-devel.sconfig
> @@ -0,0 +1,24 @@
> +#
> +# Automatically generated file; DO NOT EDIT.
> +# Barebox/arm Security Configuration
> +#
> +SCONFIG_POLICY_NAME="d