From: Sascha Hauer <s.hauer@pengutronix.de>
To: BAREBOX <barebox@lists.infradead.org>,
Sascha Hauer <s.hauer@pengutronix.de>
Cc: Ahmad Fatoum <a.fatoum@barebox.org>,
Ahmad Fatoum <a.fatoum@pengutronix.de>
Subject: Re: [PATCH v2 00/24] Add security policy support
Date: Tue, 23 Sep 2025 10:08:08 +0200 [thread overview]
Message-ID: <175861488843.2898830.2415612214704333066.b4-ty@pengutronix.de> (raw)
In-Reply-To: <20250917-security-policies-v2-0-f30769a3ff51@pengutronix.de>
On Wed, 17 Sep 2025 15:53:20 +0200, Sascha Hauer wrote:
> Security policies are a mechanism for barebox to prevent, when so
> desired, security relevant code from being executed.
>
> Security policies are controlled via a second Kconfig menu structure
> (called Sconfig) which collects security relevant options.
>
> While the normal Kconfig menu structure is about feature support
> enabled at compile time, a security policy determines whether a
> feature is allowed or prohibited at runtime with an explicit focus
> on security.
>
> [...]
Applied, thanks!
[01/24] kconfig: allow setting CONFIG_ from the outside
https://git.pengutronix.de/cgit/barebox/commit/?id=9a4281052b8f (link may not be stable)
[02/24] scripts: include scripts/include for all host tools
https://git.pengutronix.de/cgit/barebox/commit/?id=b1dd33f59373 (link may not be stable)
[03/24] kbuild: implement loopable loop_cmd
https://git.pengutronix.de/cgit/barebox/commit/?id=daaa3560414e (link may not be stable)
[04/24] Add security policy support
https://git.pengutronix.de/cgit/barebox/commit/?id=03a1030ea708 (link may not be stable)
[05/24] kbuild: allow security config use without source tree modification
https://git.pengutronix.de/cgit/barebox/commit/?id=74b1901d06f2 (link may not be stable)
[06/24] defaultenv: update PS1 according to security policy
https://git.pengutronix.de/cgit/barebox/commit/?id=98e1b8ef80b9 (link may not be stable)
[07/24] security: policy: support externally provided configs
https://git.pengutronix.de/cgit/barebox/commit/?id=d94aa6a99dfa (link may not be stable)
[08/24] commands: implement sconfig command
https://git.pengutronix.de/cgit/barebox/commit/?id=56de5ea4fe40 (link may not be stable)
[09/24] docs: security-policies: add documentation
https://git.pengutronix.de/cgit/barebox/commit/?id=9d8f7062b581 (link may not be stable)
[10/24] commands: go: add security config option
https://git.pengutronix.de/cgit/barebox/commit/?id=58401df16031 (link may not be stable)
[11/24] console: ratp: add security config option
https://git.pengutronix.de/cgit/barebox/commit/?id=d1f12e4aaaff (link may not be stable)
[12/24] bootm: support calling bootm_optional_signed_images at any time
https://git.pengutronix.de/cgit/barebox/commit/?id=48f1c4c70944 (link may not be stable)
[13/24] bootm: make unsigned image support runtime configurable
https://git.pengutronix.de/cgit/barebox/commit/?id=9dbde2ceea58 (link may not be stable)
[14/24] ARM: configs: add virt32_secure_defconfig
https://git.pengutronix.de/cgit/barebox/commit/?id=cc285c8c0ab4 (link may not be stable)
[15/24] boards: qemu-virt: add security policies
https://git.pengutronix.de/cgit/barebox/commit/?id=332277872144 (link may not be stable)
[16/24] boards: qemu-virt: allow setting policy from command line
https://git.pengutronix.de/cgit/barebox/commit/?id=cea49ae7bb88 (link may not be stable)
[17/24] test: py: add basic security policy test
https://git.pengutronix.de/cgit/barebox/commit/?id=b3773336f564 (link may not be stable)
[18/24] usbserial: add inline wrappers
https://git.pengutronix.de/cgit/barebox/commit/?id=4ee3cb57d9d9 (link may not be stable)
[19/24] security: usbgadget: add usbgadget security policy
https://git.pengutronix.de/cgit/barebox/commit/?id=0a14e84181ea (link may not be stable)
[20/24] security: fastboot: add security policy for fastboot oem
https://git.pengutronix.de/cgit/barebox/commit/?id=816b93d4bff7 (link may not be stable)
[21/24] security: shell: add policy for executing the shell
https://git.pengutronix.de/cgit/barebox/commit/?id=c3dede9a094a (link may not be stable)
[22/24] security: add security policy for loading barebox environment
https://git.pengutronix.de/cgit/barebox/commit/?id=0460dcb1b4a5 (link may not be stable)
[23/24] security: add filesystem security policies
https://git.pengutronix.de/cgit/barebox/commit/?id=7db9682703cd (link may not be stable)
[24/24] security: console: add security policy for console input
https://git.pengutronix.de/cgit/barebox/commit/?id=1d03e88d966d (link may not be stable)
Best regards,
--
Sascha Hauer <s.hauer@pengutronix.de>
prev parent reply other threads:[~2025-09-23 8:08 UTC|newest]
Thread overview: 31+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-09-17 13:53 Sascha Hauer
2025-09-17 13:53 ` [PATCH v2 01/24] kconfig: allow setting CONFIG_ from the outside Sascha Hauer
2025-09-17 13:53 ` [PATCH v2 02/24] scripts: include scripts/include for all host tools Sascha Hauer
2025-09-17 13:53 ` [PATCH v2 03/24] kbuild: implement loopable loop_cmd Sascha Hauer
2025-09-17 13:53 ` [PATCH v2 04/24] Add security policy support Sascha Hauer
2025-09-22 16:14 ` Ahmad Fatoum
2025-09-23 8:11 ` Sascha Hauer
2025-09-17 13:53 ` [PATCH v2 05/24] kbuild: allow security config use without source tree modification Sascha Hauer
2025-09-17 13:53 ` [PATCH v2 06/24] defaultenv: update PS1 according to security policy Sascha Hauer
2025-09-17 13:53 ` [PATCH v2 07/24] security: policy: support externally provided configs Sascha Hauer
2025-09-17 13:53 ` [PATCH v2 08/24] commands: implement sconfig command Sascha Hauer
2025-09-17 13:53 ` [PATCH v2 09/24] docs: security-policies: add documentation Sascha Hauer
2025-09-17 13:53 ` [PATCH v2 10/24] commands: go: add security config option Sascha Hauer
2025-09-17 13:53 ` [PATCH v2 11/24] console: ratp: " Sascha Hauer
2025-09-17 13:53 ` [PATCH v2 12/24] bootm: support calling bootm_optional_signed_images at any time Sascha Hauer
2025-09-17 13:53 ` [PATCH v2 13/24] bootm: make unsigned image support runtime configurable Sascha Hauer
2025-09-17 13:53 ` [PATCH v2 14/24] ARM: configs: add virt32_secure_defconfig Sascha Hauer
2025-09-17 13:53 ` [PATCH v2 15/24] boards: qemu-virt: add security policies Sascha Hauer
2025-09-17 13:53 ` [PATCH v2 16/24] boards: qemu-virt: allow setting policy from command line Sascha Hauer
2025-09-17 13:53 ` [PATCH v2 17/24] test: py: add basic security policy test Sascha Hauer
2025-09-17 13:53 ` [PATCH v2 18/24] usbserial: add inline wrappers Sascha Hauer
2025-09-17 13:53 ` [PATCH v2 19/24] security: usbgadget: add usbgadget security policy Sascha Hauer
2025-09-17 13:53 ` [PATCH v2 20/24] security: fastboot: add security policy for fastboot oem Sascha Hauer
2025-09-17 13:53 ` [PATCH v2 21/24] security: shell: add policy for executing the shell Sascha Hauer
2025-09-17 13:53 ` [PATCH v2 22/24] security: add security policy for loading barebox environment Sascha Hauer
2025-09-17 13:53 ` [PATCH v2 23/24] security: add filesystem security policies Sascha Hauer
2025-09-22 16:16 ` Ahmad Fatoum
2025-09-23 8:08 ` Sascha Hauer
2025-09-17 13:53 ` [PATCH v2 24/24] security: console: add security policy for console input Sascha Hauer
2025-09-22 16:18 ` [PATCH v2 00/24] Add security policy support Ahmad Fatoum
2025-09-23 8:08 ` Sascha Hauer [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=175861488843.2898830.2415612214704333066.b4-ty@pengutronix.de \
--to=s.hauer@pengutronix.de \
--cc=a.fatoum@barebox.org \
--cc=a.fatoum@pengutronix.de \
--cc=barebox@lists.infradead.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox