[PATCH 0/2] security: policy: implement age verification

[Ahmad Fatoum <a.fatoum@barebox.org>]

With barebox providing a UEFI environment, scheduling green threads
and running DOOM, barebOS is ever more becoming a reality.

But with great power, comes great responsibility - in the form of
government mandated age checking.

Fortunately, barebox's security policy framework already cleanly
separates policy from mechanism: Sconfig options define what is
permitted and IS_ALLOWED() guards enforce it at runtime.

This is a textbook fit for age verification: The age brackets are
just another axis of policy, and different security profiles can set
age thresholds appropriate to their deployment context.

This series adds SCONFIG_AB1043_AGE_{13,16,18} to represent the age
classes mandated by California's Digital Age Assurance Act (AB1043) and
puts them to use to gate access to dangerous subsystems:

  - beep: Audible tone generation constitutes noise pollution (13+)
  - I2C: Two-Wire vehicles (Mopeds) require only a learner's permit (16+)
  - SPI: Drives 4+ signals, requires full driving permit (18+)
  - CAAM: Cryptography is classified as a munition (18+)
  - fastboot: Exceeds posted speed limits (18+)

Future work would include integrating with the kernel-side support[1]
by leveraging barebox' new support for concatenating initramfs[2] to
inject a custom ramdisk init that does the appropriate prctl.

[1]: https://lore.kernel.org/all/20260401-i-hope-someone-believes-this-is-real-04f24e03944e@brauner

Ahmad Fatoum (2):
  security: policy: support age verification
  security: policy: add first age verification

 Sconfig                                       |  1 +
 commands/beep.c                               |  5 +++++
 .../qemu-virt/qemu-virt-factory.sconfig       |  8 ++++++++
 .../qemu-virt/qemu-virt-lockdown.sconfig      |  8 ++++++++
 drivers/crypto/caam/ctrl.c                    |  5 +++++
 drivers/i2c/i2c.c                             |  5 +++++
 drivers/spi/spi.c                             |  5 +++++
 drivers/usb/gadget/function/f_fastboot.c      |  5 +++++
 include/security/age.h                        | 14 +++++++++++++
 security/Sconfig.age                          | 20 +++++++++++++++++++
 security/qemu-virt-devel.sconfig              |  8 ++++++++
 security/qemu-virt-tamper.sconfig             |  8 ++++++++
 12 files changed, 92 insertions(+)
 create mode 100644 include/security/age.h
 create mode 100644 security/Sconfig.age

-- 
2.47.3