[PATCH master] environment: autoprobe environment only when CONFIG_INSECURE=y

[Ahmad Fatoum <a.fatoum@pengutronix.de>]

As things are, secure booting systems are expected to disable
CONFIG_ENV_HANDLING to avoid their behavior changing due to a barebox
environment loaded at runtime.

Still, some users may want to keep CONFIG_ENV_HANDLING enabled, but
activated only selectively. For those users, barebox autoprobing block
devices for a GPT partition with the matching UUID is undesirable.

Therefore, allow disabling this autoprobe behavior via a globalvar.
To balance convenience against security, the default for the globalvar
will depend on whether the CONFIG_INSECURE option is set.

Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
I intentionally went with a generic CONFIG_INSECURE name as I intend
to extend it in future, e.g., CONFIG_INSECURE would drop from a
misbehaving menu script to shell instead of looping indefinitely.

Additionally, I'll add a CONFIG_HAS_INSECURE_DEFAULT option that will
be select by "dual-use" options that can be used safely if care
is taken (e.g. fastboot OEM exec commands, if fastboot is only enabled
after JSON web token verification), but that's not master material.
---
 common/Kconfig       | 11 +++++++++++
 common/environment.c | 15 ++++++++++++++-
 2 files changed, 25 insertions(+), 1 deletion(-)

diff --git a/common/Kconfig b/common/Kconfig
index 2d55903c365b..b5fba72390d8 100644
--- a/common/Kconfig
+++ b/common/Kconfig
@@ -149,6 +149,17 @@ config LOCALVERSION_AUTO
 
 	  which is done within the script "scripts/setlocalversion".)
 
+config INSECURE
+	bool "enable convenient defaults that are unsuitable for secure-booting systems"
+	default y
+	help
+	  Say n here when barebox is part of a secure boot chain and you
+	  want to disable defaults that may compromise the boot chain.
+
+	  This option is a moving target. Currently it:
+
+	    - changes the default of global.env.autoprobe to 1
+
 config BANNER
 	bool "display banner"
 	default y
diff --git a/common/environment.c b/common/environment.c
index dbf4c2f52365..37adb5d67870 100644
--- a/common/environment.c
+++ b/common/environment.c
@@ -29,6 +29,7 @@
 #include <block.h>
 #include <efi/partition.h>
 #include <bootsource.h>
+#include <magicvar.h>
 #else
 #define EXPORT_SYMBOL(x)
 #endif
@@ -51,6 +52,7 @@ struct action_data {
 
 #define TMPDIR "/.defaultenv"
 
+static int global_env_autoprobe = IS_ENABLED(CONFIG_INSECURE);
 static char *default_environment_path;
 
 void default_environment_path_set(const char *path)
@@ -80,7 +82,7 @@ static struct cdev *default_environment_path_search(void)
 	struct cdev *env_cdev = NULL;
 	struct block_device *blk;
 
-	if (!IS_ENABLED(CONFIG_BLOCK))
+	if (!IS_ENABLED(CONFIG_BLOCK) || !global_env_autoprobe)
 		return NULL;
 
 	boot_node = bootsource_of_node_get(NULL);
@@ -526,3 +528,14 @@ int envfs_load(const char *filename, const char *dir, unsigned flags)
 
 	return ret;
 }
+
+#ifdef __BAREBOX__
+static int register_env_vars(void)
+{
+	globalvar_add_simple_bool("env.autoprobe", &global_env_autoprobe);
+	return 0;
+}
+postcore_initcall(register_env_vars);
+BAREBOX_MAGICVAR(global.env.autoprobe,
+                 "Automatically probe known block devices for environment");
+#endif
-- 
2.39.5