Re: Security Working Group meeting - Wednesday September 18

[Joseph Reynolds <jrey@linux.ibm.com>]

On 8/18/21 12:33 PM, Patrick Williams wrote:
> On Wed, Aug 18, 2021 at 08:54:52AM -0500, Joseph Reynolds wrote:
>   
>> 1. Wholesale changes to bitbake recipes were made.  See
>> https://lore.kernel.org/openbmc/YQ1FD5q8KbhbXVBK@heinlein/T/#u
>> <https://lore.kernel.org/openbmc/YQ1FD5q8KbhbXVBK@heinlein/T/#u>  My
>> non-specific security concern (Joseph) is accidentally mis-configuring
>> something with these changes.
> How do we ensure that any configuration you want to ensure is done,
> security-wise, is covered by tests going forward?

Here are my ideas:

For build-time configurations, I suggest documenting all important 
configuration settings.  Each item to include (links to) description of 
what the configuration setting controls, considerations for selecting 
the appropriate setting, and which recipe to append.  Then add links to 
test cases.  Examples:
- For example, if out-of-band/network IPMI is configured out of the 
image, have a test case to determine that UDP port 623 is unresponsive 
and PATCH /redfish/v1/SessionService {"IPMI": {"ServiceEnabled": true}} 
fails and has no effect.
- On the other hand, if out-of-band/network IPMI is configured into the 
image but disabled by default, have a  test case to determine that UDP 
port 623 is unresponsive and PATCH /redfish/v1/SessionService {"IPMI": 
{"ServiceEnabled": true}} succeeds, and makes port 623 active, etc.

These test cases are necessarily specific to a specific configuration, 
so they are not all appropriate to run.
That is, we can have a test case for each configuration setting, and 
configure them into or out-of the test suite as needed.

Specifically, the person responsible for configuring their downstream 
firmware image must also work to configure the appropriate tests to be 
run.  (Example: if you configure IPMI out of the image, configure your 
test suite to (a) remove tests for IPMI function, and (b) add tests to 
ensure IPMI is not present.)

I would be happy add test case links to the OpenBMC configuration wiki:
https://github.com/openbmc/openbmc/wiki/Configuration-guide

Joseph