Subject: Re: [SECURITY] FIT signature enforcement fails open when the control DTB has no /signature node
Thanks Ludwig, and thanks Tom. Understood - I'll carry the image path as a separate series and keep it out of yours. Plan, so there are no surprises: - Rename my Kconfig symbol to FIT_REQUIRE_IMAGE_SIGS (plus the SPL variant), default off, so it does not collide with FIT_REQUIRE_CONFIG_SIGS and does not disturb setups like Rockchip that use FIT_SIGNATURE for image integrity only. - Raise the visibility of the missing /signature node unconditionally, so a build without it says so on the console rather than only under debug(). - Add a test/py case covering the missing-node path. - Rebase on top of your v8 and send once it lands. I will not post before then. Shout if any of that should look different. Regards, Eva Crystal (0xiviel) XSource Security On Wed, Sep 16, 2026 at 5:18 AM Ludwig Nussel <[email protected]> wrote: > > On 9/15/26 17:41, Tom Rini wrote: > > On Tue, Sep 15, 2026 at 08:45:23PM +1200, Eva Crystal wrote: > >> Thanks Ludwig - I hadn't referenced your series in my cover letter, > >> and I should have. > >> > >> v8 4/8 does close the configuration side: fit_config_verify_required_keys() > >> gains FIT_REQUIRE_CONFIG_SIGS and fails closed when no keys with > >> required='conf' are present. > >> > >> The case I reported is the other gate. fit_image_verify_required_sigs() > >> looks up the /signature node in the control DTB and, when it is missing, > >> sets *no_sigsp = 1 and returns 0 with only a debug() message. Every caller > >> then treats the image as not requiring signatures, so nothing downstream > >> can fail. As far as I can see from your v8 hunks that path is unchanged. > >> > >> Two things follow: > >> > >> - I picked FIT_REQUIRE_CONFIG_SIGS for my Kconfig symbol, which collides > >> with yours. I'll rename mine to FIT_REQUIRE_IMAGE_SIGS (plus the SPL > >> variant), default off, since the two gates have different blast radius. > >> > >> - Jonas raised on 4/8 that Rockchip uses FIT_SIGNATURE for image integrity > >> only, not signed configurations. An image-side required-signature gate > >> hits that setup directly, which is the other reason to keep it a > >> separate > >> symbol that is off by default. > >> > >> I'll rebase on top of your series and resend once v8 lands, rather than > >> adding a patch to a series that already carries review tags. > >> > >> Tom, shout if you'd rather see it folded in instead. > > > > Since Ludwig is already working in this area, I'd like his thoughts on > > the issue / solution, and if it would make more sense to fold this in to > > his series or not. Thanks. > > I didn't touch the image path at all indeed. So perfect if Eva takes > care of that. My series already contains too many things and had too > many iterations. I fear that expanding the scope would delay acceptance > further. > > cu > Ludwig > > -- > Ludwig Nussel > Siemens AG > www.siemens.com
