[PATCH] Documentation: security: note FIT configuration choice being unsigned

[PATCH] Documentation: security: note FIT configuration choice being unsigned

[Ahmad Fatoum]

/configurations/default is not covered by any signature and is thus
trivially modifiable by an attacker. Point that out in the docs.

Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
 Documentation/user/security.rst | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/Documentation/user/security.rst b/Documentation/user/security.rst
index f8cd6bd090f2..ec42664d1e8b 100644
--- a/Documentation/user/security.rst
+++ b/Documentation/user/security.rst
@@ -83,6 +83,19 @@ can be used to compile in well known development keys into the barebox binary.
 The private keys for these keys can be found
 `[here] <https://git.pengutronix.de/cgit/ptx-code-signing-dev>`__
 
+Pinning the FIT configuration
+-----------------------------
+
+A FIT signature covers the configuration node it is placed in, the images
+that configuration refers to and their hashes. It does not cover the
+``default`` property of the top-level ``/configurations`` node, which is
+what barebox falls back to when no configuration matches the board compatible.
+
+An attacker can therefore select which of the signed configurations of a FIT is
+booted without altering any image. If that matters, ship only one configuration
+per FIT, or name the configuration explicitly, e.g.
+``bootm /dev/mmc0.kernel@conf-production``.
+
 Prevent the kernel from booting the rootfs in verity boots
 ----------------------------------------------------------
 
-- 
2.47.3