[PATCH v8 5/7] common: bootm: add policy to commandline

Fabian Pflug
2026-04-21T10:30:07Z

If security policies are used, then the variable bootm.provide_policy
can be set to automatically append the currently selected security
policy to the kernel commandline with the prefix
barebox.security.policy=
This allows the system to behave differently based on the selected
security policy.

Signed-off-by: Fabian Pflug <f.pflug@pengutronix.de>
---
common/bootm.c | 24 ++++++++++++++++++++++++
include/bootm.h | 5 +++++
2 files changed, 29 insertions(+)

diff --git a/common/bootm.c b/common/bootm.c
index 371d86ae0b..703b55a38f 100644
--- a/common/bootm.c
+++ b/common/bootm.c
@@ -20,6 +20,7 @@
#include <magicvar.h>
#include <zero_page.h>
#include <security/config.h>
+#include <security/policy.h>

static LIST_HEAD(handler_list);
static struct sconfig_notifier_block sconfig_notifier;
@@ -71,6 +72,7 @@ static int bootm_dryrun;
static int bootm_earlycon;
static int bootm_provide_machine_id;
static int bootm_provide_hostname;
+static int bootm_provide_policy;
static int bootm_verbosity;
static int bootm_efi_mode = BOOTM_EFI_AVAILABLE;

@@ -93,6 +95,7 @@ void bootm_data_init_defaults(struct bootm_data *data)
data->appendroot = bootm_appendroot;
data->provide_machine_id = bootm_provide_machine_id;
data->provide_hostname = bootm_provide_hostname;
+ data->provide_policy = bootm_provide_policy;
data->verbose = bootm_verbosity;
data->dryrun = bootm_dryrun;
data->efi_boot = bootm_efi_mode;
@@ -114,6 +117,7 @@ void bootm_data_restore_defaults(const struct bootm_data *data)
bootm_appendroot = data->appendroot;
bootm_provide_machine_id = data->provide_machine_id;
bootm_provide_hostname = data->provide_hostname;
+ bootm_provide_policy = data->provide_policy;
bootm_verbosity = data->verbose;
bootm_dryrun = data->dryrun;
bootm_efi_mode = data->efi_boot;
@@ -715,6 +719,21 @@ struct image_data *bootm_boot_prep(const struct bootm_data *bootm_data)
free(hostname_bootarg);
}

+ if (IS_ENABLED(CONFIG_SECURITY_POLICY) && bootm_data->provide_policy) {
+ char *policy_bootargs;
+ const struct security_policy *active_policy = security_policy_get_active();
+
+ if (!active_policy) {
+ pr_err("Providing policy is enabled but no policy is selected\n");
+ ret = -EINVAL;
+ goto err_out;
+ }
+
+ policy_bootargs = basprintf("barebox.security.policy=%s", active_policy->name);
+ globalvar_add_simple("linux.bootargs.dyn.policy", policy_bootargs);
+ free(policy_bootargs);
+ }
+
return data;
err_out:
bootm_boot_cleanup(data);
@@ -846,6 +865,8 @@ static int bootm_init(void)
globalvar_add_simple_bool("bootm.earlycon", &bootm_earlycon);
globalvar_add_simple_bool("bootm.provide_machine_id", &bootm_provide_machine_id);
globalvar_add_simple_bool("bootm.provide_hostname", &bootm_provide_hostname);
+ if (IS_ENABLED(CONFIG_SECURITY_POLICY))
+ globalvar_add_simple_bool("bootm.provide_policy", &bootm_provide_policy);
if (IS_ENABLED(CONFIG_BOOTM_INITRD)) {
globalvar_add_simple("bootm.initrd", NULL);
globalvar_add_simple("bootm.initrd.loadaddr", NULL);
@@ -896,3 +917,6 @@ BAREBOX_MAGICVAR(global.bootm.root_dev, "bootm default root device (overrides de
BAREBOX_MAGICVAR(global.bootm.root_param, "bootm root parameter name (normally 'root' for root=/dev/...)");
BAREBOX_MAGICVAR(global.bootm.provide_machine_id, "If true, append systemd.machine_id=$global.machine_id to Kernel command line");
BAREBOX_MAGICVAR(global.bootm.provide_hostname, "If true, append systemd.hostname=$global.hostname to Kernel command line");
+#ifdef CONFIG_SECURITY_POLICY
+BAREBOX_MAGICVAR(global.bootm.provide_policy, "Add barebox.security.policy= option to Kernel");
+#endif
diff --git a/include/bootm.h b/include/bootm.h
index 85199fc702..1a556e1e95 100644
--- a/include/bootm.h
+++ b/include/bootm.h
@@ -47,6 +47,11 @@ struct bootm_data {
* of global.hostname to Kernel.
*/
bool provide_hostname;
+ /*
+ * provide_policy - if true, try to add barebox.security.policy= with
+ * with value of currently selected policy
+ */
+ bool provide_policy;
enum bootm_efi_mode efi_boot;
unsigned long initrd_address;
unsigned long os_address;

--
2.47.3