Re: [PATCH RFC 00/17] Add security policy support

[Sascha Hauer <s.hauer@pengutronix.de>]

On Thu, 14 Aug 2025 15:06:45 +0200, Ahmad Fatoum wrote:
> Security policies are a mechanism for barebox to prevent, when so
> desired, security relevant code from being executed.
> 
> Security policies are controlled via a second Kconfig menu structure
> (called Sconfig) which collects security relevant options.
> 
> While the normal Kconfig menu structure is about feature support
> enabled at compile time, a security policy determines whether a
> feature is allowed or prohibited at runtime with an explicit focus
> on security.
> 
> [...]

Applied, thanks!

[01/1] fixup! docs: security-policies: add documentation
       (no commit info)
[01/17] kconfig: allow setting CONFIG_ from the outside
        https://git.pengutronix.de/cgit/barebox/commit/?id=9a4281052b8f (link may not be stable)
[03/17] kbuild: implement loopable loop_cmd
        https://git.pengutronix.de/cgit/barebox/commit/?id=daaa3560414e (link may not be stable)
[04/17] Add security policy support
        https://git.pengutronix.de/cgit/barebox/commit/?id=03a1030ea708 (link may not be stable)
[05/17] kbuild: allow security config use without source tree modification
        https://git.pengutronix.de/cgit/barebox/commit/?id=74b1901d06f2 (link may not be stable)
[06/17] defaultenv: update PS1 according to security policy
        https://git.pengutronix.de/cgit/barebox/commit/?id=98e1b8ef80b9 (link may not be stable)
[07/17] security: policy: support externally provided configs
        https://git.pengutronix.de/cgit/barebox/commit/?id=d94aa6a99dfa (link may not be stable)
[08/17] commands: implement sconfig command
        https://git.pengutronix.de/cgit/barebox/commit/?id=56de5ea4fe40 (link may not be stable)
[09/17] docs: security-policies: add documentation
        https://git.pengutronix.de/cgit/barebox/commit/?id=9d8f7062b581 (link may not be stable)
[10/17] commands: go: add security config option
        https://git.pengutronix.de/cgit/barebox/commit/?id=58401df16031 (link may not be stable)
[11/17] console: ratp: add security config option
        https://git.pengutronix.de/cgit/barebox/commit/?id=d1f12e4aaaff (link may not be stable)
[12/17] bootm: support calling bootm_optional_signed_images at any time
        https://git.pengutronix.de/cgit/barebox/commit/?id=48f1c4c70944 (link may not be stable)
[13/17] bootm: make unsigned image support runtime configurable
        https://git.pengutronix.de/cgit/barebox/commit/?id=9dbde2ceea58 (link may not be stable)
[14/17] ARM: configs: add virt32_secure_defconfig
        https://git.pengutronix.de/cgit/barebox/commit/?id=cc285c8c0ab4 (link may not be stable)
[15/17] boards: qemu-virt: add security policies
        https://git.pengutronix.de/cgit/barebox/commit/?id=332277872144 (link may not be stable)
[16/17] boards: qemu-virt: allow setting policy from command line
        https://git.pengutronix.de/cgit/barebox/commit/?id=cea49ae7bb88 (link may not be stable)
[17/17] test: py: add basic security policy test
        https://git.pengutronix.de/cgit/barebox/commit/?id=b3773336f564 (link may not be stable)

Best regards,
-- 
Sascha Hauer <s.hauer@pengutronix.de>