Re: [PATCH v2 00/24] Add security policy support

[Ahmad Fatoum <a.fatoum@pengutronix.de>]

Hello Sascha,

On 17.09.25 15:53, Sascha Hauer wrote:
> Changes in v2:

Thanks for taking over. I have no further comments besides the two I just
sent. I think this is ready to go into next with the two comments addressed.

Cheers,
Ahmad

> - drop security policies for each filesystem. This needs to be reworked.
>   A filesystem can safely be mounted when the source is trusted (i.e.
>   the fs image is compiled into barebox, or is authorized using upcoming
>   dm-verity support) no matter which filesystem type is mounted.
>   Therefore just add a policy which selects between "all fs allowed" and
>   "no fs allowed except ramfs".
> - fix adding policy-y to non leaf directories
> - remove policy-list files before recreating them to avoid stale entries
> - Drop $(ARCH) string from .sconfig files
> - bail out with a user friendly message when make security_* is invoked
>   with security policies being disabled in the config
> - document that policies should always go from restrictive to relaxed,
>   not the other way round
> - Link to v1: https://lore.barebox.org/20250820-security-policies-v1-0-76fde70fdbd8@pengutronix.de
> 
> Changes in v1:
> - Link to RFC:
>   https://lore.kernel.org/all/20250814130702.4039241-1-a.fatoum@pengutronix.de/
> - Add more actual security policies
> - Fix some typos in Documentation
> - Catch invalid policy names in sconfig command
> 
> Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
> ---
> Ahmad Fatoum (16):
>       kconfig: allow setting CONFIG_ from the outside
>       scripts: include scripts/include for all host tools
>       kbuild: implement loopable loop_cmd
>       Add security policy support
>       kbuild: allow security config use without source tree modification
>       defaultenv: update PS1 according to security policy
>       security: policy: support externally provided configs
>       docs: security-policies: add documentation
>       commands: go: add security config option
>       console: ratp: add security config option
>       bootm: support calling bootm_optional_signed_images at any time
>       bootm: make unsigned image support runtime configurable
>       ARM: configs: add virt32_secure_defconfig
>       boards: qemu-virt: add security policies
>       boards: qemu-virt: allow setting policy from command line
>       test: py: add basic security policy test
> 
> Sascha Hauer (8):
>       commands: implement sconfig command
>       usbserial: add inline wrappers
>       security: usbgadget: add usbgadget security policy
>       security: fastboot: add security policy for fastboot oem
>       security: shell: add policy for executing the shell
>       security: add security policy for loading barebox environment
>       security: add filesystem security policies
>       security: console: add security policy for console input
> 
>  .gitignore                                         |   4 +
>  Documentation/devel/devel.rst                      |   1 +
>  Documentation/devel/security-policies.rst          |  96 ++++
>  Documentation/user/defaultenv-2.rst                |   2 +
>  Documentation/user/security-policies.rst           | 131 +++++
>  Documentation/user/user-manual.rst                 |   1 +
>  Makefile                                           |  95 +++-
>  Sconfig                                            |  11 +
>  arch/arm/configs/virt32_secure_defconfig           | 302 ++++++++++++
>  commands/Kconfig                                   |  23 +
>  commands/Makefile                                  |   1 +
>  commands/Sconfig                                   |  12 +
>  commands/go.c                                      |   4 +
>  commands/sconfig.c                                 | 227 +++++++++
>  common/Kconfig                                     |   5 +
>  common/Sconfig                                     |  63 +++
>  common/boards/qemu-virt/Makefile                   |   5 +-
>  common/boards/qemu-virt/board.c                    |  11 +
>  common/boards/qemu-virt/commandline.c              |  74 +++
>  common/boards/qemu-virt/commandline.h              |   9 +
>  common/boards/qemu-virt/qemu-virt-factory.sconfig  |  36 ++
>  common/boards/qemu-virt/qemu-virt-lockdown.sconfig |  35 ++
>  common/bootm.c                                     |  58 ++-
>  common/console.c                                   |  11 +-
>  common/console_ctrlc.c                             |   4 +
>  common/console_simple.c                            |   7 +
>  common/environment.c                               |   6 +
>  common/fastboot.c                                  |   6 +
>  common/hush.c                                      |  13 +
>  common/parser.c                                    |   7 +
>  common/ratp/ratp.c                                 |  17 +
>  common/usbgadget.c                                 |  26 +
>  defaultenv/Makefile                                |   1 +
>  .../defaultenv-2-security-policy/bin/ps1-policy    |  20 +
>  .../defaultenv-2-security-policy/init/ps1-policy   |   1 +
>  .../init/source-colors                             |   1 +
>  defaultenv/defaultenv.c                            |   2 +
>  drivers/usb/gadget/Sconfig                         |  11 +
>  drivers/usb/gadget/composite.c                     |   4 +
>  drivers/usb/gadget/legacy/serial.c                 |   4 +
>  fs/Sconfig                                         |   5 +
>  fs/fs.c                                            |   4 +
>  include/linux/usb/usbserial.h                      |  11 +
>  include/security/config.h                          |  76 +++
>  include/security/defs.h                            |  22 +
>  include/security/policy.h                          |  54 +++
>  scripts/Kbuild.include                             |  41 ++
>  scripts/Makefile                                   |   1 -
>  scripts/Makefile.build                             |  18 +-
>  scripts/Makefile.lib                               |  47 ++
>  scripts/Makefile.policy                            |  38 ++
>  scripts/Sconfig.include                            |   6 +
>  scripts/basic/.gitignore                           |   1 +
>  scripts/basic/Makefile                             |   4 +-
>  scripts/basic/sconfigpost.c                        | 540 +++++++++++++++++++++
>  scripts/include/list.h                             |   7 +
>  scripts/kconfig/Makefile                           |   3 +
>  scripts/kconfig/list.h                             | 132 -----
>  security/Kconfig                                   |   2 +
>  security/Kconfig.policy                            | 104 ++++
>  security/Makefile                                  |  39 ++
>  security/Sconfig                                   |  34 ++
>  security/policy.c                                  | 239 +++++++++
>  security/qemu-virt-devel.sconfig                   |  36 ++
>  security/qemu-virt-tamper.sconfig                  |  35 ++
>  security/sconfig_names.c                           |  18 +
>  test/arm/virt32_secure_defconfig.yaml              |  22 +
>  test/py/test_policies.py                           |  48 ++
>  68 files changed, 2778 insertions(+), 156 deletions(-)
> ---
> base-commit: f3be3a8e9ae884bdfb116238e9049b1eb2759810
> change-id: 20250820-security-policies-43f73477d321
> 
> Best regards,


-- 
Pengutronix e.K.                           |                             |
Steuerwalder Str. 21                       | http://www.pengutronix.de/  |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |