diff mbox series

[isar-cip-core] Kconfig: Add additional features to security image

Message ID 20230711133838.437045-1-Sai.Sathujoda@toshiba-tsip.com (mailing list archive)
State Superseded
Headers show
Series [isar-cip-core] Kconfig: Add additional features to security image | expand

Commit Message

Sai.Sathujoda@toshiba-tsip.com July 11, 2023, 1:38 p.m. UTC 
From: Sai <Sai.Sathujoda@toshiba-tsip.com>

From IEC certification perspective, a security image is needed which has the
below features along with security customizations.
1. Data encryption (CR4.1)
2. Secure boot (EDR 3.14)
3. SWupdate (NDR 3.10)

Signed-off-by: Sai <Sai.Sathujoda@toshiba-tsip.com>
---
 Kconfig | 3 +++
 1 file changed, 3 insertions(+)

Comments

Jan Kiszka July 11, 2023, 4:09 p.m. UTC | #1 
On 11.07.23 15:38, Sai.Sathujoda@toshiba-tsip.com wrote:
> From: Sai <Sai.Sathujoda@toshiba-tsip.com>
> 
> From IEC certification perspective, a security image is needed which has the
> below features along with security customizations.
> 1. Data encryption (CR4.1)
> 2. Secure boot (EDR 3.14)
> 3. SWupdate (NDR 3.10)
> 
> Signed-off-by: Sai <Sai.Sathujoda@toshiba-tsip.com>
> ---
>  Kconfig | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/Kconfig b/Kconfig
> index 94e807a..a9c3425 100644
> --- a/Kconfig
> +++ b/Kconfig
> @@ -171,6 +171,9 @@ config KAS_INCLUDE_IMAGE_FORMAT
>  
>  config IMAGE_SECURITY
>  	bool "Security extensions"
> +	select IMAGE_DATA_ENCRYPTION
> +	help
> +	  This enables security customizations, data encryption, Secureboot and SWupdate, all in need for IEC certification perspective.
>  
>  config KAS_INCLUDE_SECURITY
>  	string

I rather think kas/opt/security.yml should include
kas/opt/encrypt-partitions.yml and any other kas option needed.

Jan
Pavel Machek July 11, 2023, 8:44 p.m. UTC | #2 
Hi!

> From: Sai <Sai.Sathujoda@toshiba-tsip.com>
> 
> From IEC certification perspective, a security image is needed which has the
> below features along with security customizations.
> 1. Data encryption (CR4.1)
> 2. Secure boot (EDR 3.14)
> 3. SWupdate (NDR 3.10)
> 
> Signed-off-by: Sai <Sai.Sathujoda@toshiba-tsip.com>
> ---
>  Kconfig | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/Kconfig b/Kconfig
> index 94e807a..a9c3425 100644
> --- a/Kconfig
> +++ b/Kconfig
> @@ -171,6 +171,9 @@ config KAS_INCLUDE_IMAGE_FORMAT
>  
>  config IMAGE_SECURITY
>  	bool "Security extensions"
> +	select IMAGE_DATA_ENCRYPTION
> +	help
> +	  This enables security customizations, data encryption, Secureboot and SWupdate, all in need for IEC certification perspective.
>  

Is Kconfig help text usually wrapped at 80-or-so columns? (I know this
applies to kernel kconfig, but it also may be case here...?)

Best regards,
								Pavel
Sai.Sathujoda@toshiba-tsip.com July 12, 2023, 5:11 a.m. UTC | #3 
Hi Jan.

We chose this approach because the kas-menu will help user to understand what features are included in the image when security extensions is selected. Your suggestion is also good.

Do you think there are any drawbacks in modifying kas-menu approach, Jan.

Thanks & Regards,
Sai Ashrith (T S I P)

-----Original Message-----
From: cip-dev@lists.cip-project.org <cip-dev@lists.cip-project.org> On Behalf Of Jan Kiszka via lists.cip-project.org
Sent: Tuesday, July 11, 2023 9:39 PM
To: ashrith sai(ＴＳＩＰ) <Sai.Sathujoda@toshiba-tsip.com>; cip-dev@lists.cip-project.org
Cc: dinesh kumar(ＴＳＩＰ TMIEC ODG Porting) <dinesh.kumar@toshiba-tsip.com>; hayashi kazuhiro(林 和宏 ＤＭＥ ○ＤＩＧ□ＭＰＳ○ＭＰ４) <kazuhiro3.hayashi@toshiba.co.jp>
Subject: Re: [cip-dev] [isar-cip-core] Kconfig: Add additional features to security image

On 11.07.23 15:38, Sai.Sathujoda@toshiba-tsip.com wrote:
> From: Sai <Sai.Sathujoda@toshiba-tsip.com>
> 
> From IEC certification perspective, a security image is needed which 
> has the below features along with security customizations.
> 1. Data encryption (CR4.1)
> 2. Secure boot (EDR 3.14)
> 3. SWupdate (NDR 3.10)
> 
> Signed-off-by: Sai <Sai.Sathujoda@toshiba-tsip.com>
> ---
>  Kconfig | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/Kconfig b/Kconfig
> index 94e807a..a9c3425 100644
> --- a/Kconfig
> +++ b/Kconfig
> @@ -171,6 +171,9 @@ config KAS_INCLUDE_IMAGE_FORMAT
>  
>  config IMAGE_SECURITY
>  	bool "Security extensions"
> +	select IMAGE_DATA_ENCRYPTION
> +	help
> +	  This enables security customizations, data encryption, Secureboot and SWupdate, all in need for IEC certification perspective.
>  
>  config KAS_INCLUDE_SECURITY
>  	string

I rather think kas/opt/security.yml should include kas/opt/encrypt-partitions.yml and any other kas option needed.

Jan

--
Siemens AG, Technology
Competence Center Embedded Linux
Jan Kiszka July 12, 2023, 6:04 a.m. UTC | #4 
On 12.07.23 07:11, Sai.Sathujoda@toshiba-tsip.com wrote:
> Hi Jan.
> 
> We chose this approach because the kas-menu will help user to understand what features are included in the image when security extensions is selected. Your suggestion is also good.
> 
> Do you think there are any drawbacks in modifying kas-menu approach, Jan.

Yes, because now the Kconfig choices deviate from the default you get
when calling

kas-container build kas-cip.yml:kas/board/...:kas/opt/security.yml

Jan

> 
> Thanks & Regards,
> Sai Ashrith (T S I P)
> 
> -----Original Message-----
> From: cip-dev@lists.cip-project.org <cip-dev@lists.cip-project.org> On Behalf Of Jan Kiszka via lists.cip-project.org
> Sent: Tuesday, July 11, 2023 9:39 PM
> To: ashrith sai(ＴＳＩＰ) <Sai.Sathujoda@toshiba-tsip.com>; cip-dev@lists.cip-project.org
> Cc: dinesh kumar(ＴＳＩＰ TMIEC ODG Porting) <dinesh.kumar@toshiba-tsip.com>; hayashi kazuhiro(林 和宏 ＤＭＥ ○ＤＩＧ□ＭＰＳ○ＭＰ４) <kazuhiro3.hayashi@toshiba.co.jp>
> Subject: Re: [cip-dev] [isar-cip-core] Kconfig: Add additional features to security image
> 
> On 11.07.23 15:38, Sai.Sathujoda@toshiba-tsip.com wrote:
>> From: Sai <Sai.Sathujoda@toshiba-tsip.com>
>>
>> From IEC certification perspective, a security image is needed which 
>> has the below features along with security customizations.
>> 1. Data encryption (CR4.1)
>> 2. Secure boot (EDR 3.14)
>> 3. SWupdate (NDR 3.10)
>>
>> Signed-off-by: Sai <Sai.Sathujoda@toshiba-tsip.com>
>> ---
>>  Kconfig | 3 +++
>>  1 file changed, 3 insertions(+)
>>
>> diff --git a/Kconfig b/Kconfig
>> index 94e807a..a9c3425 100644
>> --- a/Kconfig
>> +++ b/Kconfig
>> @@ -171,6 +171,9 @@ config KAS_INCLUDE_IMAGE_FORMAT
>>  
>>  config IMAGE_SECURITY
>>  	bool "Security extensions"
>> +	select IMAGE_DATA_ENCRYPTION
>> +	help
>> +	  This enables security customizations, data encryption, Secureboot and SWupdate, all in need for IEC certification perspective.
>>  
>>  config KAS_INCLUDE_SECURITY
>>  	string
> 
> I rather think kas/opt/security.yml should include kas/opt/encrypt-partitions.yml and any other kas option needed.
> 
> Jan
> 
> --
> Siemens AG, Technology
> Competence Center Embedded Linux
>
diff mbox series

Patch

diff --git a/Kconfig b/Kconfig
index 94e807a..a9c3425 100644
--- a/Kconfig
+++ b/Kconfig
@@ -171,6 +171,9 @@  config KAS_INCLUDE_IMAGE_FORMAT
 
 config IMAGE_SECURITY
 	bool "Security extensions"
+	select IMAGE_DATA_ENCRYPTION
+	help
+	  This enables security customizations, data encryption, Secureboot and SWupdate, all in need for IEC certification perspective.
 
 config KAS_INCLUDE_SECURITY
 	string