Re: To restrict IPMI commands

From: Vernon Mauery <vernon.mauery@linux.intel.com>
To: "P. K. Lee (李柏寬)" <P.K.Lee@quantatw.com>
Cc: "openbmc@lists.ozlabs.org" <openbmc@lists.ozlabs.org>
Subject: Re: To restrict IPMI commands
Date: Mon, 18 Mar 2019 11:31:08 -0700	[thread overview]
Message-ID: <20190318183108.GE44612@mauery.jf.intel.com> (raw)
In-Reply-To: <9674FC29-B121-444E-A123-E99A31181766@quantatw.com>

On 16-Mar-2019 01:04 PM, P. K. Lee (李柏寬) wrote:
>Hi Vernon,
>
>Thank you for providing a new filtering mechanism that looks very flexible, but I have a question.
>I have tried the filter that allows filtering of commands by whitelistFilter, but the channel of request must be channelSystemIfac to check the contents of the whitelist.
>What puzzles me is why channelSystemIfac is in the constraint? This constraint will cause the whitelist to fail when the user calls the IPMI command via the LAN.
>If the user wants to use the whitelist vis the LAN, is there a better way except for removing the channelSystemIfac restriction?
>Do I need to create another whitelist filter for the LAN?

The whitelist filter I implemented was just one to replace the original 
filter that was there before the architecture changes. The restriction 
about the incoming interface is something that was already there and 
somebody at IBM might be a better resource for the 'why' question. At 
some point, I would like to make it an optional part of the build 
because it may not be something that everyone needs. But it is a good 
starting place for how to write a filter.

You can feel free to write a new filter as part of a 'provider' library 
just like you write ipmi command handlers and register them, you can 
write a filter and register it.

--Vernon

>Regards,
>PK
>
>> On Feb 23, 2019, at 04:05, Vernon Mauery <vernon.mauery@linux.intel.com> wrote:
>>
>> On 22-Feb-2019 03:03 AM, P. K. Lee (李柏寬) wrote:
>>> Hi,
>>>
>>> Does anyone know how to restrict the IPMI command execution via out-of-band?
>>>
>>> I know that the IPMI commands via in-band can use the whitelist mechanism to restrict whether the commands can access the BMC, but I can't use this for the out-of-band.
>>>
>>> If there is currently no restriction mechanism for the out-of-band, I will try to add the whitelist function for it just like the in-band.
>>
>> There is a mechanism in the works for this already. It is a generic filter provider that allows filtering of commands based on any criteria. See https://gerrit.openbmc-project.xyz/c/openbmc/phosphor-host-ipmid/+/13896 for the current implementation.
>>
>> --Vernon
>