[Openembedded-architecture] Trusted/secure/etc layers

[Tom Rini]

On Thu, May 03, 2018 at 09:28:40AM -0400, Trevor Woerner wrote:
> On Wed 2018-05-02 @ 08:27:01 PM, Tom Rini wrote:
> > On Wed, May 02, 2018 at 11:31:02PM +0000, Otavio Salvador wrote:
> > > A DISTRO_FEATURES or a MACHINE_FEATURES? It seems more related to the
> > > machine.
> 
> Maybe I'm misunderstanding the inherent assumptions of this thread, and maybe
> I'm overestimating the effort involved, but my guess is that although we could
> throw a bunch of recipes into oe-core or meta-oe to support some of this work,
> actually getting secure boot to work on any specific platform is going to need
> a good chunk of work by the BSP maintainers?
> 
> Would it be fair to say that working secure boot is mostly a BSP issue?
> 
> Perhaps a better question might be: if we make this a *_FEATURE in oe-core,
> does this mean oe-core needs to take on all of the tpm and secure-boot
> recipes? Is it possible to standardize a *_FEATURE in oe-core, but make its
> use dependent on an external layer?

This is partly what I've been asking about.  What can we and should we
do for oe-core (and IMHO, the very much related topic of
meta-openembedded / git.openembedded.org hosted layers) related to
security?

My opinion is that we need:
- Sufficient hooks in anything that's in oe-core and used for/by popular
  security features that something can be hooked in.  AFAICT we seem to
  have this, but we need more people that have poked more technologies
  that fall under the umbrella of security to chime in.
- Try and get the 3+ layers for dealing with a TPM to coalesce into one
  layer, or have a real good understanding of why it can't be.
- Work with layers that provide various security features so that it is
  easy to apply them to an arbitrary BSP that follows best practices, or
  an arbitrary distro that again follows best practices.

-- 
Tom
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: not available
URL: <http://lists.openembedded.org/pipermail/openembedded-architecture/attachments/20180503/b71ba6e9/attachment-0002.sig>