[Openembedded-architecture] Trusted/secure/etc layers

[Tom Rini]

On Wed, May 02, 2018 at 11:31:02PM +0000, Otavio Salvador wrote:
> On Wed, May 2, 2018 at 7:44 PM Tom Rini <trini at konsulko.com> wrote:
> 
> > On Wed, May 02, 2018 at 06:26:31AM +0200, Patrick Ohly wrote:
> > > Trevor Woerner <twoerner at gmail.com> writes:
> > > > Philip Tricca (for Intel) has been leading a lot of TSS work as well,
> he also
> > > > maintains meta-measured https://github.com/flihp/meta-measured for OE
> recipes.
> > >
> > > Note that he is very open to the idea of moving those recipes elsewhere
> > > and deprecating meta-measured. The recipes themselves aren't getting
> > > updated as often as they used to be, too.
> 
> > Trying to break this down into small tasks, there's a number of cases
> > for making use of GRUB_BUILDIN in the context of security (Intel TXT, UEFI
> > secure boot, I bet the AMD equivalent of TXT).  So we have the generic
> > hook we need (good!).
> 
> > As an architecture question do we want to add more DISTRO_FEATURES
> > (intel-txt, efi-secure-boot, amd-something) and have the main grub-efi
> > recipe look at those hooks and further update GRUB_BUILDIN?  Or just as
> > part of documentation (and perhaps more content to
> > local.conf.sample.extended) take care of it there?  I think I lean
> > towards more official DISTRO_FEATURES as that will also help us merge a
> > number of scc/cfg fragments from this area as well.
> 
> A DISTRO_FEATURES or a MACHINE_FEATURES? It seems more related to the
> machine.

Oh probably.  But the thing is a lot of these aren't exactly machine
features but architecture features.  What I think we need to avoid
somehow is the need to whack N machine.conf files to enable something
that's fairly commonly possible.  For example, efi-secure-boot is
(relatively) easily done in both intel-corei7-64 and qemux86 and
qemux86-64 and intel-core2-32.

-- 
Tom
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: not available
URL: <http://lists.openembedded.org/pipermail/openembedded-architecture/attachments/20180502/7fcae74a/attachment-0002.sig>