From mboxrd@z Thu Jan 1 00:00:00 1970 From: Stefano Babic Date: Mon, 27 Jun 2016 12:38:49 +0200 Subject: [U-Boot] [PATCH 2/2] usbarmory: Add board_run_command() function In-Reply-To: <20160620161826.GD26512@core.inversepath.com> References: <20160620152149.21249-1-andrej@inversepath.com> <20160620152149.21249-2-andrej@inversepath.com> <57680FEC.6030207@denx.de> <20160620161826.GD26512@core.inversepath.com> Message-ID: <57710239.7010906@denx.de> List-Id: MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: u-boot@lists.denx.de Hi Andrej, On 20/06/2016 18:18, Andrej Rosano wrote: >> >> I ten to NACK this. You can do exactly the same with a U-Boot script, >> and if you want to have this as default, you can change your default >> environment. This is just a wrapper around the hush shell. > > The intention of the patch is to boot the kernel while having the CLI disabled > (CONFIG_CMDLINE=n). The U-Boot script needs the CLI to be enabled AFAIK. > > It is better having the CLI disabled when using the Verified Boot, otherwise > there are chances to bypass the FIT image verification (e.g. using md/mw > commands in case are available): Why is it not enough to disable the CONSOLE ? I mean, if there is no user interface (and this is done in a lot of ways, for example setting stdin / stdout), there is no ways to bypass it because the interface is not availabel. Or is there some other security issues I am not aware of ? Best regards, Stefano Babic -- ===================================================================== DENX Software Engineering GmbH, Managing Director: Wolfgang Denk HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany Phone: +49-8142-66989-53 Fax: +49-8142-66989-80 Email: sbabic at denx.de =====================================================================