* Turning off the D-Bus REST API by default
@ 2021-08-12 14:10 Ali Ahmed
2021-08-12 14:55 ` Patrick Williams
2021-08-12 20:31 ` i.kononenko
0 siblings, 2 replies; 9+ messages in thread
From: Ali Ahmed @ 2021-08-12 14:10 UTC (permalink / raw)
To: openbmc
[-- Attachment #1: Type: text/plain, Size: 502 bytes --]
I know there was some previous discussion on this.
https://gerrit.openbmc-project.xyz/c/openbmc/bmcweb/+/29344 is making
the default setting for D-BUS REST API disabled. The D-Bus REST allows
authenticated users access to privileged information that may be above
their permission level.
After this commit to use phosphor-webui or D-Bus REST, you will need
to set -Drest=enabled in your bbappend. Note: webui-vue uses Redfish
and will not be impacted. Let me know if you have any concerns.
-Ali Ahmed
[-- Attachment #2: Type: text/html, Size: 2071 bytes --]
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: Turning off the D-Bus REST API by default
2021-08-12 14:10 Turning off the D-Bus REST API by default Ali Ahmed
@ 2021-08-12 14:55 ` Patrick Williams
2021-08-12 17:56 ` Garrett, Mike (HPE Server Firmware)
2021-08-12 20:47 ` Ed Tanous
2021-08-12 20:31 ` i.kononenko
1 sibling, 2 replies; 9+ messages in thread
From: Patrick Williams @ 2021-08-12 14:55 UTC (permalink / raw)
To: Ali Ahmed; +Cc: openbmc
[-- Attachment #1: Type: text/plain, Size: 2727 bytes --]
On Thu, Aug 12, 2021 at 09:10:01AM -0500, Ali Ahmed wrote:
> I know there was some previous discussion on this.
> https://gerrit.openbmc-project.xyz/c/openbmc/bmcweb/+/29344 is making
> the default setting for D-BUS REST API disabled. The D-Bus REST allows
> authenticated users access to privileged information that may be above
> their permission level.
>
> After this commit to use phosphor-webui or D-Bus REST, you will need
> to set -Drest=enabled in your bbappend. Note: webui-vue uses Redfish
> and will not be impacted. Let me know if you have any concerns.
>
> -Ali Ahmed
The following machines/meta-layers seem to still be relying on phosphor-webui.
Is anyone signed up to either switch these to webui-vue or do the bbappend?
```
meta-hpe/meta-common/recipes-phosphor/packagegroups/packagegroup-hpe-apps.bb: phosphor-webui \
meta-hpe/meta-common/recipes-phosphor/packagegroups/packagegroup-obmc-apps.bbappend: phosphor-webui \
meta-ibm/meta-palmetto/recipes-phosphor/packagegroups/packagegroup-obmc-apps.bbappend:RDEPENDS:${PN}-inventory:append:palmetto = " openpower-occ-control phosphor-webui"
meta-ibm/meta-romulus/recipes-phosphor/packagegroups/packagegroup-obmc-apps.bbappend:RDEPENDS:${PN}-extras:append:romulus = " phosphor-webui phosphor-image-signing"
meta-ibm/recipes-phosphor/packagegroups/packagegroup-obmc-apps.bbappend:RDEPENDS:${PN}-extras:append:ibm-ac-server = " ${POWER_SERVICE_PACKAGES_AC_SERVER} witherspoon-power-supply-sync phosphor-webui"
meta-ibm/recipes-phosphor/packagegroups/packagegroup-obmc-apps.bbappend:RDEPENDS:${PN}-extras:append:mihawk = " phosphor-webui phosphor-image-signing wistron-ipmi-oem ${POWER_SERVICE_PACKAGES_AC_SERVER}"
meta-ibm/recipes-phosphor/packagegroups/packagegroup-obmc-apps.bbappend:RDEPENDS:${PN}-extras:remove:witherspoon-tacoma = "obmc-ikvm liberation-fonts uart-render-controller phosphor-webui"
meta-inspur/meta-on5263m5/recipes-inspur/packagegroups/packagegroup-inspur-apps.bb: phosphor-webui \
meta-intel-openbmc/meta-common/recipes-intel/packagegroups/packagegroup-intel-apps.bb: phosphor-webui \
meta-lenovo/meta-common/recipes-lenovo/packagegroups/packagegroup-lenovo-apps.bb: phosphor-webui \
meta-quanta/meta-olympus-nuvoton/recipes-olympus-nuvoton/packagegroups/packagegroup-olympus-nuvoton-apps.bb: phosphor-webui \
meta-supermicro/meta-common/recipes-supermicro/packagegroups/packagegroup-supermicro-apps.bb: phosphor-webui \
```
Romulus and Palmetto at least are ones we utilize in CI.
Is whatever hardware testing we do on Witherspoon now moved over to the Redfish
APIs? Everything in openbmc-test-automation.
--
Patrick Williams
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
^ permalink raw reply [flat|nested] 9+ messages in thread* RE: Turning off the D-Bus REST API by default
2021-08-12 14:55 ` Patrick Williams
@ 2021-08-12 17:56 ` Garrett, Mike (HPE Server Firmware)
2021-08-12 20:47 ` Ed Tanous
1 sibling, 0 replies; 9+ messages in thread
From: Garrett, Mike (HPE Server Firmware) @ 2021-08-12 17:56 UTC (permalink / raw)
To: Patrick Williams, Ali Ahmed; +Cc: openbmc
Thanks Patrick - I plan to update the HPE machine very soon with several of these fixes.
Mike
> -----Original Message-----
> From: openbmc <openbmc-
> bounces+mike.garrett=hpe.com@lists.ozlabs.org> On Behalf Of Patrick
> Williams
> Sent: Thursday, August 12, 2021 9:56 AM
> To: Ali Ahmed <ama213000@gmail.com>
> Cc: openbmc@lists.ozlabs.org
> Subject: Re: Turning off the D-Bus REST API by default
>
> On Thu, Aug 12, 2021 at 09:10:01AM -0500, Ali Ahmed wrote:
> > I know there was some previous discussion on this.
> > https://gerrit.openbmc-project.xyz/c/openbmc/bmcweb/+/29344 is
> making
> > the default setting for D-BUS REST API disabled. The D-Bus REST allows
> > authenticated users access to privileged information that may be above
> > their permission level.
> >
> > After this commit to use phosphor-webui or D-Bus REST, you will need
> > to set -Drest=enabled in your bbappend. Note: webui-vue uses Redfish
> > and will not be impacted. Let me know if you have any concerns.
> >
> > -Ali Ahmed
>
> The following machines/meta-layers seem to still be relying on phosphor-
> webui.
> Is anyone signed up to either switch these to webui-vue or do the
> bbappend?
>
> ```
> meta-hpe/meta-common/recipes-phosphor/packagegroups/packagegroup-
> hpe-apps.bb: phosphor-webui \
> meta-hpe/meta-common/recipes-phosphor/packagegroups/packagegroup-
> obmc-apps.bbappend: phosphor-webui \
> meta-ibm/meta-palmetto/recipes-phosphor/packagegroups/packagegroup-
> obmc-apps.bbappend:RDEPENDS:${PN}-inventory:append:palmetto = "
> openpower-occ-control phosphor-webui"
> meta-ibm/meta-romulus/recipes-phosphor/packagegroups/packagegroup-
> obmc-apps.bbappend:RDEPENDS:${PN}-extras:append:romulus = "
> phosphor-webui phosphor-image-signing"
> meta-ibm/recipes-phosphor/packagegroups/packagegroup-obmc-
> apps.bbappend:RDEPENDS:${PN}-extras:append:ibm-ac-server = "
> ${POWER_SERVICE_PACKAGES_AC_SERVER} witherspoon-power-supply-
> sync phosphor-webui"
> meta-ibm/recipes-phosphor/packagegroups/packagegroup-obmc-
> apps.bbappend:RDEPENDS:${PN}-extras:append:mihawk = " phosphor-
> webui phosphor-image-signing wistron-ipmi-oem
> ${POWER_SERVICE_PACKAGES_AC_SERVER}"
> meta-ibm/recipes-phosphor/packagegroups/packagegroup-obmc-
> apps.bbappend:RDEPENDS:${PN}-extras:remove:witherspoon-tacoma =
> "obmc-ikvm liberation-fonts uart-render-controller phosphor-webui"
> meta-inspur/meta-on5263m5/recipes-inspur/packagegroups/packagegroup-
> inspur-apps.bb: phosphor-webui \
> meta-intel-openbmc/meta-common/recipes-
> intel/packagegroups/packagegroup-intel-apps.bb: phosphor-webui \
> meta-lenovo/meta-common/recipes-lenovo/packagegroups/packagegroup-
> lenovo-apps.bb: phosphor-webui \
> meta-quanta/meta-olympus-nuvoton/recipes-olympus-
> nuvoton/packagegroups/packagegroup-olympus-nuvoton-apps.bb:
> phosphor-webui \
> meta-supermicro/meta-common/recipes-
> supermicro/packagegroups/packagegroup-supermicro-apps.bb:
> phosphor-webui \
> ```
>
> Romulus and Palmetto at least are ones we utilize in CI.
>
> Is whatever hardware testing we do on Witherspoon now moved over to the
> Redfish APIs? Everything in openbmc-test-automation.
>
> --
> Patrick Williams
^ permalink raw reply [flat|nested] 9+ messages in thread* Re: Turning off the D-Bus REST API by default
2021-08-12 14:55 ` Patrick Williams
2021-08-12 17:56 ` Garrett, Mike (HPE Server Firmware)
@ 2021-08-12 20:47 ` Ed Tanous
1 sibling, 0 replies; 9+ messages in thread
From: Ed Tanous @ 2021-08-12 20:47 UTC (permalink / raw)
To: Patrick Williams; +Cc: Ali Ahmed, OpenBMC Maillist
On Thu, Aug 12, 2021 at 7:56 AM Patrick Williams <patrick@stwcx.xyz> wrote:
>
> On Thu, Aug 12, 2021 at 09:10:01AM -0500, Ali Ahmed wrote:
> > I know there was some previous discussion on this.
> > https://gerrit.openbmc-project.xyz/c/openbmc/bmcweb/+/29344 is making
> > the default setting for D-BUS REST API disabled. The D-Bus REST allows
> > authenticated users access to privileged information that may be above
> > their permission level.
> >
> > After this commit to use phosphor-webui or D-Bus REST, you will need
> > to set -Drest=enabled in your bbappend. Note: webui-vue uses Redfish
> > and will not be impacted. Let me know if you have any concerns.
> >
> > -Ali Ahmed
>
> The following machines/meta-layers seem to still be relying on phosphor-webui.
> Is anyone signed up to either switch these to webui-vue or do the bbappend?
>
> ```
> meta-hpe/meta-common/recipes-phosphor/packagegroups/packagegroup-hpe-apps.bb: phosphor-webui \
> meta-hpe/meta-common/recipes-phosphor/packagegroups/packagegroup-obmc-apps.bbappend: phosphor-webui \
> meta-ibm/meta-palmetto/recipes-phosphor/packagegroups/packagegroup-obmc-apps.bbappend:RDEPENDS:${PN}-inventory:append:palmetto = " openpower-occ-control phosphor-webui"
> meta-ibm/meta-romulus/recipes-phosphor/packagegroups/packagegroup-obmc-apps.bbappend:RDEPENDS:${PN}-extras:append:romulus = " phosphor-webui phosphor-image-signing"
> meta-ibm/recipes-phosphor/packagegroups/packagegroup-obmc-apps.bbappend:RDEPENDS:${PN}-extras:append:ibm-ac-server = " ${POWER_SERVICE_PACKAGES_AC_SERVER} witherspoon-power-supply-sync phosphor-webui"
> meta-ibm/recipes-phosphor/packagegroups/packagegroup-obmc-apps.bbappend:RDEPENDS:${PN}-extras:append:mihawk = " phosphor-webui phosphor-image-signing wistron-ipmi-oem ${POWER_SERVICE_PACKAGES_AC_SERVER}"
> meta-ibm/recipes-phosphor/packagegroups/packagegroup-obmc-apps.bbappend:RDEPENDS:${PN}-extras:remove:witherspoon-tacoma = "obmc-ikvm liberation-fonts uart-render-controller phosphor-webui"
> meta-inspur/meta-on5263m5/recipes-inspur/packagegroups/packagegroup-inspur-apps.bb: phosphor-webui \
> meta-intel-openbmc/meta-common/recipes-intel/packagegroups/packagegroup-intel-apps.bb: phosphor-webui \
> meta-lenovo/meta-common/recipes-lenovo/packagegroups/packagegroup-lenovo-apps.bb: phosphor-webui \
> meta-quanta/meta-olympus-nuvoton/recipes-olympus-nuvoton/packagegroups/packagegroup-olympus-nuvoton-apps.bb: phosphor-webui \
> meta-supermicro/meta-common/recipes-supermicro/packagegroups/packagegroup-supermicro-apps.bb: phosphor-webui \
> ```
>
I suspect we should put together a patch to leave rest-dbus this
enabled for the above systems at the same time we change the default.
With that said, based on Patricks other email, a lot of them are
slated to be obsoleted anyway, so maybe the problem will solve itself?
I wonder if there's some clever yocto way we could just turn
phosphor-webui into a distro feature, and flip the bmcweb flag on
automatically?
> Romulus and Palmetto at least are ones we utilize in CI.
>
> Is whatever hardware testing we do on Witherspoon now moved over to the Redfish
> APIs? Everything in openbmc-test-automation.
>
> --
> Patrick Williams
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: Turning off the D-Bus REST API by default
2021-08-12 14:10 Turning off the D-Bus REST API by default Ali Ahmed
2021-08-12 14:55 ` Patrick Williams
@ 2021-08-12 20:31 ` i.kononenko
2021-08-12 20:41 ` Ed Tanous
2021-08-12 22:37 ` Ali Ahmed
1 sibling, 2 replies; 9+ messages in thread
From: i.kononenko @ 2021-08-12 20:31 UTC (permalink / raw)
To: Ali Ahmed, openbmc
Ali,
On 12.08.2021 17:10, Ali Ahmed wrote:
> After this commit to use phosphor-webui or D-Bus REST, you will need
> to set -Drest=enabled in your bbappend. Note: webui-vue uses Redfish
> and will not be impacted. Let me know if you have any concerns.
As far I knew, the webui-vue uses REST API to retrieve the TPM status.
Please, look to the link below [1]
Links:
[1] https://github.com/openbmc/webui-vue/blob/6dba4be6125c10210bafa030ac17737d3a9b28b8/src/store/modules/Operations/BootSettingsStore.js#L73
>
> -Ali Ahmed
>
--
Best regards,
Igor Kononenko
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: Turning off the D-Bus REST API by default
2021-08-12 20:31 ` i.kononenko
@ 2021-08-12 20:41 ` Ed Tanous
2021-08-13 16:05 ` Gunnar Mills
2021-08-12 22:37 ` Ali Ahmed
1 sibling, 1 reply; 9+ messages in thread
From: Ed Tanous @ 2021-08-12 20:41 UTC (permalink / raw)
To: i.kononenko, Gunnar Mills, Derick Montague; +Cc: Ali Ahmed, OpenBMC Maillist
On Thu, Aug 12, 2021 at 1:32 PM i.kononenko <i.kononenko@yadro.com> wrote:
>
> Ali,
>
> On 12.08.2021 17:10, Ali Ahmed wrote:
>
> > After this commit to use phosphor-webui or D-Bus REST, you will need
> > to set -Drest=enabled in your bbappend. Note: webui-vue uses Redfish
> > and will not be impacted. Let me know if you have any concerns.
>
> As far I knew, the webui-vue uses REST API to retrieve the TPM status.
> Please, look to the link below [1]
@gunnar @derick isn't this against one of the primary design goals of
webui-vue? Was it intentionally merged? It seems like having
webui-vue rely on dbus-rest just keeps digging the hole deeper on this
initial thing, which is getting dbus-rest disabled by default.
>
> Links:
> [1] https://github.com/openbmc/webui-vue/blob/6dba4be6125c10210bafa030ac17737d3a9b28b8/src/store/modules/Operations/BootSettingsStore.js#L73
> >
> > -Ali Ahmed
> >
>
> --
> Best regards,
>
> Igor Kononenko
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: Turning off the D-Bus REST API by default
2021-08-12 20:41 ` Ed Tanous
@ 2021-08-13 16:05 ` Gunnar Mills
2021-08-13 17:20 ` Ed Tanous
0 siblings, 1 reply; 9+ messages in thread
From: Gunnar Mills @ 2021-08-13 16:05 UTC (permalink / raw)
To: Ed Tanous, i.kononenko, Derick Montague; +Cc: Ali Ahmed, OpenBMC Maillist
On 8/12/2021 2:41 PM, Ed Tanous wrote:
> On Thu, Aug 12, 2021 at 1:32 PM i.kononenko <i.kononenko@yadro.com> wrote:
>>
>> Ali,
>>
>> On 12.08.2021 17:10, Ali Ahmed wrote:
>>
>>> After this commit to use phosphor-webui or D-Bus REST, you will need
>>> to set -Drest=enabled in your bbappend. Note: webui-vue uses Redfish
>>> and will not be impacted. Let me know if you have any concerns.
>>
>> As far I knew, the webui-vue uses REST API to retrieve the TPM status.
>> Please, look to the link below [1]
>
> @gunnar @derick isn't this against one of the primary design goals of
> webui-vue? Was it intentionally merged? It seems like having
> webui-vue rely on dbus-rest just keeps digging the hole deeper on this
> initial thing, which is getting dbus-rest disabled by default.
>
I think when this was merged 2 years ago, when webui-vue was still very
very young, the thinking was we will switch to Redfish when TPMenable is
implemented in Redfish and there was value to having a working page.
This does go against a core design goal of webui-vue. I certainly would
-1 any commit trying to add D-Bus REST API to webui-vue today. I think
this is just a TODO that hasn't been implemented.
https://github.com/openbmc/webui-vue/blame/6dba4be6125c10210bafa030ac17737d3a9b28b8/src/store/modules/Operations/BootSettingsStore.js#L74
GET TrustedModuleRequiredToBoot is available today. The PATCH is in
review here: https://gerrit.openbmc-project.xyz/c/openbmc/bmcweb/+/44044
We will push a commit to switch this to Redfish.
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: Turning off the D-Bus REST API by default
2021-08-13 16:05 ` Gunnar Mills
@ 2021-08-13 17:20 ` Ed Tanous
0 siblings, 0 replies; 9+ messages in thread
From: Ed Tanous @ 2021-08-13 17:20 UTC (permalink / raw)
To: Gunnar Mills; +Cc: Ali Ahmed, OpenBMC Maillist, i.kononenko
On Fri, Aug 13, 2021 at 9:05 AM Gunnar Mills <gmills@linux.vnet.ibm.com> wrote:
>
> On 8/12/2021 2:41 PM, Ed Tanous wrote:
> > On Thu, Aug 12, 2021 at 1:32 PM i.kononenko <i.kononenko@yadro.com> wrote:
> >>
> >> Ali,
> >>
> >> On 12.08.2021 17:10, Ali Ahmed wrote:
> >>
> >>> After this commit to use phosphor-webui or D-Bus REST, you will need
> >>> to set -Drest=enabled in your bbappend. Note: webui-vue uses Redfish
> >>> and will not be impacted. Let me know if you have any concerns.
> >>
> >> As far I knew, the webui-vue uses REST API to retrieve the TPM status.
> >> Please, look to the link below [1]
> >
> > @gunnar @derick isn't this against one of the primary design goals of
> > webui-vue? Was it intentionally merged? It seems like having
> > webui-vue rely on dbus-rest just keeps digging the hole deeper on this
> > initial thing, which is getting dbus-rest disabled by default.
> >
>
> I think when this was merged 2 years ago, when webui-vue was still very
> very young, the thinking was we will switch to Redfish when TPMenable is
> implemented in Redfish and there was value to having a working page.
> This does go against a core design goal of webui-vue. I certainly would
> -1 any commit trying to add D-Bus REST API to webui-vue today. I think
> this is just a TODO that hasn't been implemented.
> https://github.com/openbmc/webui-vue/blame/6dba4be6125c10210bafa030ac17737d3a9b28b8/src/store/modules/Operations/BootSettingsStore.js#L74
Makes sense. I didn't realize it was so old; Thanks for the info Gunnar.
>
> GET TrustedModuleRequiredToBoot is available today. The PATCH is in
> review here: https://gerrit.openbmc-project.xyz/c/openbmc/bmcweb/+/44044
>
> We will push a commit to switch this to Redfish.
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: Turning off the D-Bus REST API by default
2021-08-12 20:31 ` i.kononenko
2021-08-12 20:41 ` Ed Tanous
@ 2021-08-12 22:37 ` Ali Ahmed
1 sibling, 0 replies; 9+ messages in thread
From: Ali Ahmed @ 2021-08-12 22:37 UTC (permalink / raw)
To: i.kononenko; +Cc: openbmc
[-- Attachment #1: Type: text/plain, Size: 982 bytes --]
Hey Igor,
Yes, but we are currently working to merge TPM Policy into bmcweb, and then
webui-vue can move over to using Redfish for this property.
You can see the review status here:
https://gerrit.openbmc-project.xyz/c/openbmc/bmcweb/+/44044.
Ed if you get a chance can you take a look at this review?
On Thu, Aug 12, 2021 at 3:31 PM i.kononenko <i.kononenko@yadro.com> wrote:
> Ali,
>
> On 12.08.2021 17:10, Ali Ahmed wrote:
>
> > After this commit to use phosphor-webui or D-Bus REST, you will need
> > to set -Drest=enabled in your bbappend. Note: webui-vue uses Redfish
> > and will not be impacted. Let me know if you have any concerns.
>
> As far I knew, the webui-vue uses REST API to retrieve the TPM status.
> Please, look to the link below [1]
>
> Links:
> [1]
> https://github.com/openbmc/webui-vue/blob/6dba4be6125c10210bafa030ac17737d3a9b28b8/src/store/modules/Operations/BootSettingsStore.js#L73
> >
> > -Ali Ahmed
> >
>
> --
> Best regards,
>
> Igor Kononenko
>
[-- Attachment #2: Type: text/html, Size: 1726 bytes --]
^ permalink raw reply [flat|nested] 9+ messages in thread
end of thread, other threads:[~2021-08-13 17:22 UTC | newest]
Thread overview: 9+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-08-12 14:10 Turning off the D-Bus REST API by default Ali Ahmed
2021-08-12 14:55 ` Patrick Williams
2021-08-12 17:56 ` Garrett, Mike (HPE Server Firmware)
2021-08-12 20:47 ` Ed Tanous
2021-08-12 20:31 ` i.kononenko
2021-08-12 20:41 ` Ed Tanous
2021-08-13 16:05 ` Gunnar Mills
2021-08-13 17:20 ` Ed Tanous
2021-08-12 22:37 ` Ali Ahmed
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).