As things are, secure booting systems are expected to disable
CONFIG_ENV_HANDLING to avoid their behavior changing due to a barebox
environment loaded at runtime.
Still, some users may want to keep CONFIG_ENV_HANDLING enabled, but
activated only selectively. For those users, barebox autoprobing block
devices for a GPT partition with the matching UUID is undesirable.
Therefore, allow disabling this autoprobe behavior via a globalvar.
To balance convenience against security, the default for the globalvar
will depend on whether the CONFIG_INSECURE option is set.
Signed-off-by: Ahmad Fatoum <a.fatoum@xxxxxxxxxxxxxx>
---
I intentionally went with a generic CONFIG_INSECURE name as I intend
to extend it in future, e.g., CONFIG_INSECURE would drop from a
misbehaving menu script to shell instead of looping indefinitely.
Additionally, I'll add a CONFIG_HAS_INSECURE_DEFAULT option that will
be select by "dual-use" options that can be used safely if care
is taken (e.g. fastboot OEM exec commands, if fastboot is only enabled
after JSON web token verification), but that's not master material.
---
common/Kconfig | 11 +++++++++++
common/environment.c | 15 ++++++++++++++-
2 files changed, 25 insertions(+), 1 deletion(-)
diff --git a/common/Kconfig b/common/Kconfig
index 2d55903c365b..b5fba72390d8 100644
--- a/common/Kconfig
+++ b/common/Kconfig
@@ -149,6 +149,17 @@ config LOCALVERSION_AUTO
which is done within the script "scripts/setlocalversion".)
+config INSECURE
+ bool "enable convenient defaults that are unsuitable for secure-booting systems"
+ default y
+ help
+ Say n here when barebox is part of a secure boot chain and you
+ want to disable defaults that may compromise the boot chain.
+
+ This option is a moving target. Currently it:
+
+ - changes the default of global.env.autoprobe to 1
+
config BANNER
bool "display banner"
default y
diff --git a/common/environment.c b/common/environment.c
index dbf4c2f52365..37adb5d67870 100644
--- a/common/environment.c
+++ b/common/environment.c
@@ -29,6 +29,7 @@
#include <block.h>
#include <efi/partition.h>
#include <bootsource.h>
+#include <magicvar.h>
#else
#define EXPORT_SYMBOL(x)
#endif
@@ -51,6 +52,7 @@ struct action_data {
#define TMPDIR "/.defaultenv"
+static int global_env_autoprobe = IS_ENABLED(CONFIG_INSECURE);
static char *default_environment_path;
void default_environment_path_set(const char *path)
@@ -80,7 +82,7 @@ static struct cdev *default_environment_path_search(void)
struct cdev *env_cdev = NULL;
struct block_device *blk;
- if (!IS_ENABLED(CONFIG_BLOCK))
+ if (!IS_ENABLED(CONFIG_BLOCK) || !global_env_autoprobe)
return NULL;
boot_node = bootsource_of_node_get(NULL);
@@ -526,3 +528,14 @@ int envfs_load(const char *filename, const char *dir, unsigned flags)
return ret;
}
+
+#ifdef __BAREBOX__
+static int register_env_vars(void)
+{
+ globalvar_add_simple_bool("env.autoprobe", &global_env_autoprobe);
+ return 0;
+}
+postcore_initcall(register_env_vars);
+BAREBOX_MAGICVAR(global.env.autoprobe,
+ "Automatically probe known block devices for environment");
+#endif
--
2.39.5
