search

toradex / meta-toradex-security

MIT License
4 stars 9 forks source link

u-boot: send hardening warning messages to stderr #68

Closed rborn-tx closed 1 month ago

rborn-tx commented 2 months ago

Send most of the hardening warning/error messages to U-Boot's stderr to increase the chances they are seen.

Related-to: https://github.com/toradex/meta-toradex-security/issues/64

jsrc27 commented 2 months ago

Do you think the following warning/error messages also need to be sent to stderr?: https://github.com/toradex/meta-toradex-security/blob/2c5ff367dc53d4ac43cd29e90583ef4e0e94dad8/recipes-bsp/u-boot/files/0001-toradex-common-add-command-whitelisting-modules.patch#L1093

https://github.com/toradex/meta-toradex-security/blob/2c5ff367dc53d4ac43cd29e90583ef4e0e94dad8/recipes-bsp/u-boot/files/0004-toradex-integrate-bootm-protection-downstream.patch#L128 (same on upstream)

https://github.com/toradex/meta-toradex-security/blob/2c5ff367dc53d4ac43cd29e90583ef4e0e94dad8/recipes-bsp/u-boot/files/0004-toradex-integrate-bootm-protection-downstream.patch#L103 (same on upstream)

Or are these different compared to the messages changed in this PR?

rborn-tx commented 2 months ago

Do you think the following warning/error messages also need to be sent to stderr?:

@jsrc27 Good question!

Basically in this PR I chose to send to stderr only messages starting with a double hash mark; those are the messages I considered (during development) as being important and more likely to happen (of course based on personal guess).

The messages you highlighted of course are important (same as hundreds of other errors U-Boot might detect, unrelated to the hardening) but they should be detected during development in which case I'd expect nobody to be executing U-Boot with stdout redirected to nulldev for example.

jsrc27 commented 2 months ago

@rborn-tx Okay that makes sense just wanted to check/confirm. No other comments from my side then.