[Openembedded-architecture] Trusted/secure/etc layers

[Tom Rini]

On Tue, May 01, 2018 at 04:33:39PM +0100, Burton, Ross wrote:

> Hi,
> 
> As discussed on the planning call, there are lots of layers which all
> solve a part of the trusted/secure problem.
> 
> So let's crowdsource the collation: can everyone who knows of or is
> maintaining a relevant layer please post it here, and talk about what
> they plan to work on.

I think there's a few different aspects of "security" that we should
handle in oe-core, and another set that we should see about handling
more... endorsedly? under openembedded.org.

For example, today, for IMA via RPM (which Mark Hatle noted on the call
has drawbacks in some use cases), everything you need for that is in
oe-core as the RPM side has been upstreamed and sign_rpm.bbclass handles
the rest, so meta-secure-core provides a little sanity check wrapper
around that.  If/when upstream deb support for IMA happens,
sign_deb.bbclass should be in oe-core to handle that.

As an example of what I mean by endorsedly, there's at least 3 different
layers with TPM1/TPM2 general support in them, and I bet a good deal of
overlap.  We should work with the maintainers of these other layers to
see why meta-security/meta-tpm doesn't have what they need today and
then figure out how to meet those needs as much as possible.  ie we
should be able to generically set a knob and get TPM support in the
kernel, U-Boot and anywhere else that has TPM support as a configurable
options.  But having TPM as part of the chain of trust in IMA or UEFI
secure boot or unlocking your encrypted volumes or ... might be best
left as an exercise to a layer that adds that support.  That layer
should have to only set things up correctly for the
meta-security/meta-tpm layer.

And I'd like to help on some amount of all of the above.  And I'm being
vague here because I don't know what parts of all of this the people
that already have a layer wouldn't want to pick up if asked/offered.

-- 
Tom
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: not available
URL: <http://lists.openembedded.org/pipermail/openembedded-architecture/attachments/20180501/0ebaacf0/attachment-0002.sig>