search

ARM-software / arm-systemready

Arm SystemReady
Apache License 2.0
54 stars 62 forks source link

Fix backdoor host tools leakage #203

Closed daniel-thompson closed 2 months ago

daniel-thompson commented 3 months ago

This PR fixes a couple of oddities in the sie-keys recipe.

In particular the recipe really shouldn't be adding /usr/bin to the PATH since that undermines all of OpenEmbedded's careful work to isolate from the host configuration. Also I couldn't figure out why sie-keys needs it own private copy of efitools to I replaced that with the corresponding native package too.

I originally found these issues because the IR ACS would not build without installing additional undocumented host packages. However rather than update the build documentation, in this case it is better to fix things by making the existing documentation true instead!

daniel-thompson commented 3 months ago

There's something very odd going in with the dependency tracking here: ebbr-sct does not break when I build a full image after fixing sie-keys. It also looks from the logs like ebbr-sct is trying to grab files from the sie-keys working directory (which I suspect will also break bitbake in some rather subtle ways... although probably isn't the problem here).

I'll take a look.

daniel-thompson commented 3 months ago

@edhay I made similar changes to ebbr-sct and woden-image to get things to build (new versions of patch #1 and #2). I also fixed ebbr-sct so that is doesn't "steal" files from the workdir.

I noticed a further issue with ebbr-sct:do_configure not being idempotent (which makes incremental builds fail) since but haven't fixed it since it is not related to my changes. I can file an issue if you want to track it though.

edhay commented 2 months ago

Hello @daniel-thompson, Thank you so much for the PR and fixes. We will file an issue for ebbr-sct:do_configure not being idempotent and track the same to closure.