Re: Security Working Group meeting - Wednesday September 18 - results

[Joseph Reynolds <jrey@linux.ibm.com>]

On 8/18/21 8:54 AM, Joseph Reynolds wrote:
> This is a reminder of the OpenBMC Security Working Group meeting 
> scheduled for this Wednesday September 18 at 10:00am PDT.
>
> We'll discuss the following items on the agenda 
> <https://docs.google.com/document/d/1b7x9BaxsfcukQDqbvZsU2ehMq4xoJRQvLxxsDUWmAOI/edit>, 
> and anything else that comes up:
>
Attended: Joseph Reynolds, Bruce Mitchell, James Mihm, Jiang Zhang, 
Richard Wilkins, Surya Intel, Daniil Egranov Arm

> 1. Wholesale changes to bitbake recipes were made.  See 
> https://lore.kernel.org/openbmc/YQ1FD5q8KbhbXVBK@heinlein/T/#u 
> <https://lore.kernel.org/openbmc/YQ1FD5q8KbhbXVBK@heinlein/T/#u> My 
> non-specific security concern (Joseph) is accidentally mis-configuring 
> something with these changes.

DISCUSSION: None


> 2. Gerrit review - The BMCWeb session idle timeout changed to 30 
> minutes (was 60): 
> https://gerrit.openbmc-project.xyz/c/openbmc/bmcweb/+/45658 
> <https://gerrit.openbmc-project.xyz/c/openbmc/bmcweb/+/45658>
DISCUSSION: None
> 3. Yocto is planning a security configuration guide.  See 
> https://bugzilla.yoctoproject.org/show_bug.cgi?id=14509 
> <https://bugzilla.yoctoproject.org/show_bug.cgi?id=14509>

DISCUSSION: None

Bonus items:

4. What database?  Bugzilla?  github.com issues?

DISCUSSION:

James and Surya looked at github issues.  Will test drive github.  Need 
dashboard/query function.  Worries about accidental disclosure.

Tianocore uses bugzilla per Richard.  UEFI has a separate database (not 
bugzilla).

Use github private branches?

What development process for security code reviews (Github reviews vs 
gerrit)?

Next steps: James and Surya will come up with critical objections to 
using github issues.


5 How to add session timeouts to host console?

DISCUSSION:

See the diagram in the README under 
https://github.com/openbmc/obmc-console 
<https://github.com/openbmc/obmc-console>.

We thought obmc-console-client was the right place to implement the 
timeout mechanism.

I created https://github.com/openbmc/obmc-console/issues/18 
<https://github.com/openbmc/obmc-console/issues/18>.




>
> Access, agenda and notes are in the wiki:
> https://github.com/openbmc/openbmc/wiki/Security-working-group 
> <https://github.com/openbmc/openbmc/wiki/Security-working-group>
>
> - Joseph