From mboxrd@z Thu Jan 1 00:00:00 1970 From: Lukasz Majewski Date: Sat, 7 Sep 2019 00:23:18 +0200 Subject: [U-Boot] Using CONFIG_ENV_FLAGS_LIST In-Reply-To: <3bc23f5e-0f30-1003-6d08-d648eeaa7205@denx.de> References: <3bc23f5e-0f30-1003-6d08-d648eeaa7205@denx.de> Message-ID: <20190907002318.363808bd@jawa> List-Id: MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: u-boot@lists.denx.de Hi Claudius, > Hi, > > I am currently looking into variable flags in order to make some > variables read-only for secure boot. > > The idea is that the u-boot binary is signed, while the environment > file/partition is not. So the built-in default environment of u-boot > can be trusted, while the external environment cannot. The assumption > is that those flags can be used to customize the validation when the > external environment is loaded or scripts/commands are executed. > > From the '/README' I gather that the access attributes can be any of > "any", "read-only", "write-once" or "change-default". > > I first tried to restrict the variables by choosing 'read-only', but > apparently this applies to the internal environment as well, and now > those variables are not loaded from the internal environment. > > Then I tried 'write-once', this worked now as expected from within > u-boot, but I could modify the environment from the linux userspace > via fw_setenv and those changes appear in u-boot as well. The same for > 'change-default'. > > Is there another way to fill the internal environment variable hash > table, so that 'read-only' works as expected? > > Heiko wrote some patches that change the behavior of the environment > loading so that the internal environment is loaded first before the > external environment. This way 'write-once' should work as expected, > but I think 'read-only' should work that way already and we are > missing something here. I think that Wolfgang had a long discussion with Takahiro AKASHI (both CC'ed) about similar problem with u-boot envs. For example: https://patchwork.ozlabs.org/patch/1158770/ > > Thanks, > Claudius > Best regards, Lukasz Majewski -- DENX Software Engineering GmbH, Managing Director: Wolfgang Denk HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany Phone: (+49)-8142-66989-59 Fax: (+49)-8142-66989-80 Email: lukma at denx.de -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 488 bytes Desc: OpenPGP digital signature URL: