[PATCH 1/2] security: policy: support age verification

[Ahmad Fatoum <a.fatoum@barebox.org>]

California's Digital Age Assurance Act mandates age-appropriate feature
gating for operating systems. As barebOS qualifies, implement compliance
via the security policy framework.

The security policies for virt32_secure_defconfig have been updated
accordingly:

 - lockdown: field-deployed devices are unsupervised and adult operators
   can not be assumed

 - tamper: Tampering is clearly a sign of immaturity

 - devel: Much barebox development relates to drivers, which requires
   at least 16+ with adult supervision

 - factory: all age brackets allowed, because child labor laws
   already imply factory workers to be 18+

Signed-off-by: Ahmad Fatoum <a.fatoum@barebox.org>
---
 Sconfig                                       |  1 +
 .../qemu-virt/qemu-virt-factory.sconfig       |  8 ++++++++
 .../qemu-virt/qemu-virt-lockdown.sconfig      |  8 ++++++++
 include/security/age.h                        | 14 +++++++++++++
 security/Sconfig.age                          | 20 +++++++++++++++++++
 security/qemu-virt-devel.sconfig              |  8 ++++++++
 security/qemu-virt-tamper.sconfig             |  8 ++++++++
 7 files changed, 67 insertions(+)
 create mode 100644 include/security/age.h
 create mode 100644 security/Sconfig.age

diff --git a/Sconfig b/Sconfig
index cdb2ceccb1b4..2c7804453cb9 100644
--- a/Sconfig
+++ b/Sconfig
@@ -9,3 +9,4 @@ source "common/Sconfig"
 source "drivers/usb/gadget/Sconfig"
 source "commands/Sconfig"
 source "fs/Sconfig"
+source "security/Sconfig.age"
diff --git a/common/boards/qemu-virt/qemu-virt-factory.sconfig b/common/boards/qemu-virt/qemu-virt-factory.sconfig
index 7fb35e9b722d..a9d9f021e832 100644
--- a/common/boards/qemu-virt/qemu-virt-factory.sconfig
+++ b/common/boards/qemu-virt/qemu-virt-factory.sconfig
@@ -34,3 +34,11 @@ SCONFIG_USB_GADGET=y
 # end of Command Policy
 
 SCONFIG_FS_EXTERNAL=y
+
+#
+# AB1043 Age Verification
+#
+SCONFIG_AB1043_AGE_13=y
+SCONFIG_AB1043_AGE_16=y
+SCONFIG_AB1043_AGE_18=y
+# end of AB1043 Age Verification
diff --git a/common/boards/qemu-virt/qemu-virt-lockdown.sconfig b/common/boards/qemu-virt/qemu-virt-lockdown.sconfig
index 04763d2233b4..1683d16b47f9 100644
--- a/common/boards/qemu-virt/qemu-virt-lockdown.sconfig
+++ b/common/boards/qemu-virt/qemu-virt-lockdown.sconfig
@@ -33,3 +33,11 @@ SCONFIG_SHELL=y
 # end of Command Policy
 
 # SCONFIG_FS_EXTERNAL is not set
+
+#
+# AB1043 Age Verification
+#
+# SCONFIG_AB1043_AGE_13 is not set
+# SCONFIG_AB1043_AGE_16 is not set
+# SCONFIG_AB1043_AGE_18 is not set
+# end of AB1043 Age Verification
diff --git a/include/security/age.h b/include/security/age.h
new file mode 100644
index 000000000000..609defde04fb
--- /dev/null
+++ b/include/security/age.h
@@ -0,0 +1,14 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+#ifndef __SECURITY_AGE_H
+#define __SECURITY_AGE_H
+
+#include <security/config.h>
+
+/*
+ * California AB1043 Digital Age Verification Act compliance.
+ * Maps age brackets to Sconfig security policy options.
+ */
+
+#define IS_OF_AGE(n)	IS_ALLOWED(SCONFIG_AB1043_AGE_##n)
+
+#endif /* __SECURITY_AGE_H */
diff --git a/security/Sconfig.age b/security/Sconfig.age
new file mode 100644
index 000000000000..f403e8757a0c
--- /dev/null
+++ b/security/Sconfig.age
@@ -0,0 +1,20 @@
+# SPDX-License-Identifier: GPL-2.0-only
+
+menu "AB1043 Age Verification"
+
+config AB1043_AGE_13
+	bool "Allow operators aged 13+"
+	help
+	  Permit access to features requiring a minimum operator age of 13.
+
+config AB1043_AGE_16
+	bool "Allow operators aged 16+"
+	help
+	  Permit access to features requiring a minimum operator age of 16.
+
+config AB1043_AGE_18
+	bool "Allow operators aged 18+"
+	help
+	  Permit access to features requiring a minimum operator age of 18.
+
+endmenu
diff --git a/security/qemu-virt-devel.sconfig b/security/qemu-virt-devel.sconfig
index 423374dfbdef..1fde43a95456 100644
--- a/security/qemu-virt-devel.sconfig
+++ b/security/qemu-virt-devel.sconfig
@@ -34,3 +34,11 @@ SCONFIG_CMD_GO=y
 # end of Command Policy
 
 SCONFIG_FS_EXTERNAL=y
+
+#
+# AB1043 Age Verification
+#
+SCONFIG_AB1043_AGE_13=y
+SCONFIG_AB1043_AGE_16=y
+# SCONFIG_AB1043_AGE_18 is not set
+# end of AB1043 Age Verification
diff --git a/security/qemu-virt-tamper.sconfig b/security/qemu-virt-tamper.sconfig
index 10058c5b6101..1eaa0d64042a 100644
--- a/security/qemu-virt-tamper.sconfig
+++ b/security/qemu-virt-tamper.sconfig
@@ -33,3 +33,11 @@ SCONFIG_POLICY_NAME="tamper"
 # end of Command Policy
 
 # SCONFIG_FS_EXTERNAL is not set
+
+#
+# AB1043 Age Verification
+#
+SCONFIG_AB1043_AGE_13=y
+# SCONFIG_AB1043_AGE_16 is not set
+# SCONFIG_AB1043_AGE_18 is not set
+# end of AB1043 Age Verification
-- 
2.47.3