On 2026-10-29T16:23:07+11:00, Frieder Schrempf <[email protected]> wrote: > bootstd: rauc: Optionally boot with a built-in command > > The RAUC bootmeth boots a slot by running boot.scr or boot.scr.uimg > from its boot partition. Nothing authenticates this partition, so with > verified boot, whoever can write it can run any U-Boot command, for > example booting an unsigned kernel or changing the kernel command line. > Signing the script does not close this reliably as source skips all > checks if the environment sets verify=no, which RAUC systems must keep > writable for BOOT_ORDER and BOOT_x_LEFT, and it accepts a FIT script > without configurations, whose signature is then only checked against > keys required for images, not configurations. > > Add CONFIG_BOOTMETH_RAUC_BOOTCMD to set a command built into U-Boot > that boots the slot instead. It sees the same environment variables as > the boot script. The boot partition then contains nothing that U-Boot > executes, and the code that loads the script is left out of the build. > > The option is empty by default, which keeps loading the boot script. > > Assisted-by: LLM > Signed-off-by: Frieder Schrempf <[email protected]> > > boot/Kconfig | 16 ++++++++++++++++ > boot/bootmeth_rauc.c | 21 ++++++++++++++------- > doc/develop/bootstd/rauc.rst | 8 ++++++++ > 3 files changed, 38 insertions(+), 7 deletions(-)
Reviewed-by: Simon Glass <[email protected]>
