Turning off the D-Bus REST API by default

Turning off the D-Bus REST API by default

[Ali Ahmed]

[-- Attachment #1: Type: text/plain, Size: 502 bytes --]

I know there was some previous discussion on this.
https://gerrit.openbmc-project.xyz/c/openbmc/bmcweb/+/29344 is making
the default setting for D-BUS REST API disabled. The D-Bus REST allows
authenticated users access to privileged information that may be above
their permission level.

After this commit to use phosphor-webui or D-Bus REST, you will need
to set -Drest=enabled in your bbappend. Note: webui-vue uses Redfish
and will not be impacted. Let me know if you have any concerns.

-Ali Ahmed

[-- Attachment #2: Type: text/html, Size: 2071 bytes --]

Re: Turning off the D-Bus REST API by default

[Patrick Williams]

[-- Attachment #1: Type: text/plain, Size: 2727 bytes --]

On Thu, Aug 12, 2021 at 09:10:01AM -0500, Ali Ahmed wrote:
> I know there was some previous discussion on this.
> https://gerrit.openbmc-project.xyz/c/openbmc/bmcweb/+/29344 is making
> the default setting for D-BUS REST API disabled. The D-Bus REST allows
> authenticated users access to privileged information that may be above
> their permission level.
> 
> After this commit to use phosphor-webui or D-Bus REST, you will need
> to set -Drest=enabled in your bbappend. Note: webui-vue uses Redfish
> and will not be impacted. Let me know if you have any concerns.
> 
> -Ali Ahmed

The following machines/meta-layers seem to still be relying on phosphor-webui.
Is anyone signed up to either switch these to webui-vue or do the bbappend?

```
meta-hpe/meta-common/recipes-phosphor/packagegroups/packagegroup-hpe-apps.bb:        phosphor-webui \
meta-hpe/meta-common/recipes-phosphor/packagegroups/packagegroup-obmc-apps.bbappend:                           phosphor-webui \
meta-ibm/meta-palmetto/recipes-phosphor/packagegroups/packagegroup-obmc-apps.bbappend:RDEPENDS:${PN}-inventory:append:palmetto = " openpower-occ-control phosphor-webui"
meta-ibm/meta-romulus/recipes-phosphor/packagegroups/packagegroup-obmc-apps.bbappend:RDEPENDS:${PN}-extras:append:romulus = " phosphor-webui phosphor-image-signing"
meta-ibm/recipes-phosphor/packagegroups/packagegroup-obmc-apps.bbappend:RDEPENDS:${PN}-extras:append:ibm-ac-server = " ${POWER_SERVICE_PACKAGES_AC_SERVER} witherspoon-power-supply-sync phosphor-webui"
meta-ibm/recipes-phosphor/packagegroups/packagegroup-obmc-apps.bbappend:RDEPENDS:${PN}-extras:append:mihawk = " phosphor-webui phosphor-image-signing wistron-ipmi-oem ${POWER_SERVICE_PACKAGES_AC_SERVER}"
meta-ibm/recipes-phosphor/packagegroups/packagegroup-obmc-apps.bbappend:RDEPENDS:${PN}-extras:remove:witherspoon-tacoma = "obmc-ikvm liberation-fonts uart-render-controller phosphor-webui"
meta-inspur/meta-on5263m5/recipes-inspur/packagegroups/packagegroup-inspur-apps.bb:        phosphor-webui \
meta-intel-openbmc/meta-common/recipes-intel/packagegroups/packagegroup-intel-apps.bb:        phosphor-webui \
meta-lenovo/meta-common/recipes-lenovo/packagegroups/packagegroup-lenovo-apps.bb:        phosphor-webui \
meta-quanta/meta-olympus-nuvoton/recipes-olympus-nuvoton/packagegroups/packagegroup-olympus-nuvoton-apps.bb:        phosphor-webui \
meta-supermicro/meta-common/recipes-supermicro/packagegroups/packagegroup-supermicro-apps.bb:        phosphor-webui \
```

Romulus and Palmetto at least are ones we utilize in CI.

Is whatever hardware testing we do on Witherspoon now moved over to the Redfish
APIs?  Everything in openbmc-test-automation.

-- 
Patrick Williams

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

RE: Turning off the D-Bus REST API by default

[Garrett, Mike (HPE Server Firmware)]

Thanks Patrick - I plan to update the HPE machine very soon with several of these fixes.

Mike

> -----Original Message-----
> From: openbmc <openbmc-
> bounces+mike.garrett=hpe.com@lists.ozlabs.org> On Behalf Of Patrick
> Williams
> Sent: Thursday, August 12, 2021 9:56 AM
> To: Ali Ahmed <ama213000@gmail.com>
> Cc: openbmc@lists.ozlabs.org
> Subject: Re: Turning off the D-Bus REST API by default
> 
> On Thu, Aug 12, 2021 at 09:10:01AM -0500, Ali Ahmed wrote:
> > I know there was some previous discussion on this.
> > https://gerrit.openbmc-project.xyz/c/openbmc/bmcweb/+/29344 is
> making
> > the default setting for D-BUS REST API disabled. The D-Bus REST allows
> > authenticated users access to privileged information that may be above
> > their permission level.
> >
> > After this commit to use phosphor-webui or D-Bus REST, you will need
> > to set -Drest=enabled in your bbappend. Note: webui-vue uses Redfish
> > and will not be impacted. Let me know if you have any concerns.
> >
> > -Ali Ahmed
> 
> The following machines/meta-layers seem to still be relying on phosphor-
> webui.
> Is anyone signed up to either switch these to webui-vue or do the
> bbappend?
> 
> ```
> meta-hpe/meta-common/recipes-phosphor/packagegroups/packagegroup-
> hpe-apps.bb:        phosphor-webui \
> meta-hpe/meta-common/recipes-phosphor/packagegroups/packagegroup-
> obmc-apps.bbappend:                           phosphor-webui \
> meta-ibm/meta-palmetto/recipes-phosphor/packagegroups/packagegroup-
> obmc-apps.bbappend:RDEPENDS:${PN}-inventory:append:palmetto = "
> openpower-occ-control phosphor-webui"
> meta-ibm/meta-romulus/recipes-phosphor/packagegroups/packagegroup-
> obmc-apps.bbappend:RDEPENDS:${PN}-extras:append:romulus = "
> phosphor-webui phosphor-image-signing"
> meta-ibm/recipes-phosphor/packagegroups/packagegroup-obmc-
> apps.bbappend:RDEPENDS:${PN}-extras:append:ibm-ac-server = "
> ${POWER_SERVICE_PACKAGES_AC_SERVER} witherspoon-power-supply-
> sync phosphor-webui"
> meta-ibm/recipes-phosphor/packagegroups/packagegroup-obmc-
> apps.bbappend:RDEPENDS:${PN}-extras:append:mihawk = " phosphor-
> webui phosphor-image-signing wistron-ipmi-oem
> ${POWER_SERVICE_PACKAGES_AC_SERVER}"
> meta-ibm/recipes-phosphor/packagegroups/packagegroup-obmc-
> apps.bbappend:RDEPENDS:${PN}-extras:remove:witherspoon-tacoma =
> "obmc-ikvm liberation-fonts uart-render-controller phosphor-webui"
> meta-inspur/meta-on5263m5/recipes-inspur/packagegroups/packagegroup-
> inspur-apps.bb:        phosphor-webui \
> meta-intel-openbmc/meta-common/recipes-
> intel/packagegroups/packagegroup-intel-apps.bb:        phosphor-webui \
> meta-lenovo/meta-common/recipes-lenovo/packagegroups/packagegroup-
> lenovo-apps.bb:        phosphor-webui \
> meta-quanta/meta-olympus-nuvoton/recipes-olympus-
> nuvoton/packagegroups/packagegroup-olympus-nuvoton-apps.bb:
> phosphor-webui \
> meta-supermicro/meta-common/recipes-
> supermicro/packagegroups/packagegroup-supermicro-apps.bb:
> phosphor-webui \
> ```
> 
> Romulus and Palmetto at least are ones we utilize in CI.
> 
> Is whatever hardware testing we do on Witherspoon now moved over to the
> Redfish APIs?  Everything in openbmc-test-automation.
> 
> --
> Patrick Williams

Re: Turning off the D-Bus REST API by default

[i.kononenko]

Ali,

On 12.08.2021 17:10, Ali Ahmed wrote:

> After this commit to use phosphor-webui or D-Bus REST, you will need
> to set -Drest=enabled in your bbappend. Note: webui-vue uses Redfish
> and will not be impacted. Let me know if you have any concerns.

As far I knew, the webui-vue uses REST API to retrieve the TPM status.
Please, look to the link below [1]

Links: 
[1]  https://github.com/openbmc/webui-vue/blob/6dba4be6125c10210bafa030ac17737d3a9b28b8/src/store/modules/Operations/BootSettingsStore.js#L73 
> 
> -Ali Ahmed
> 

-- 
Best regards,

Igor Kononenko

Re: Turning off the D-Bus REST API by default

[Ed Tanous]

On Thu, Aug 12, 2021 at 1:32 PM i.kononenko <i.kononenko@yadro.com> wrote:
>
> Ali,
>
> On 12.08.2021 17:10, Ali Ahmed wrote:
>
> > After this commit to use phosphor-webui or D-Bus REST, you will need
> > to set -Drest=enabled in your bbappend. Note: webui-vue uses Redfish
> > and will not be impacted. Let me know if you have any concerns.
>
> As far I knew, the webui-vue uses REST API to retrieve the TPM status.
> Please, look to the link below [1]

@gunnar @derick  isn't this against one of the primary design goals of
webui-vue?  Was it intentionally merged?  It seems like having
webui-vue rely on dbus-rest just keeps digging the hole deeper on this
initial thing, which is getting dbus-rest disabled by default.

>
> Links:
> [1]  https://github.com/openbmc/webui-vue/blob/6dba4be6125c10210bafa030ac17737d3a9b28b8/src/store/modules/Operations/BootSettingsStore.js#L73
> >
> > -Ali Ahmed
> >
>
> --
> Best regards,
>
> Igor Kononenko

Re: Turning off the D-Bus REST API by default

[Ed Tanous]

On Thu, Aug 12, 2021 at 7:56 AM Patrick Williams <patrick@stwcx.xyz> wrote:
>
> On Thu, Aug 12, 2021 at 09:10:01AM -0500, Ali Ahmed wrote:
> > I know there was some previous discussion on this.
> > https://gerrit.openbmc-project.xyz/c/openbmc/bmcweb/+/29344 is making
> > the default setting for D-BUS REST API disabled. The D-Bus REST allows
> > authenticated users access to privileged information that may be above
> > their permission level.
> >
> > After this commit to use phosphor-webui or D-Bus REST, you will need
> > to set -Drest=enabled in your bbappend. Note: webui-vue uses Redfish
> > and will not be impacted. Let me know if you have any concerns.
> >
> > -Ali Ahmed
>
> The following machines/meta-layers seem to still be relying on phosphor-webui.
> Is anyone signed up to either switch these to webui-vue or do the bbappend?
>
> ```
> meta-hpe/meta-common/recipes-phosphor/packagegroups/packagegroup-hpe-apps.bb:        phosphor-webui \
> meta-hpe/meta-common/recipes-phosphor/packagegroups/packagegroup-obmc-apps.bbappend:                           phosphor-webui \
> meta-ibm/meta-palmetto/recipes-phosphor/packagegroups/packagegroup-obmc-apps.bbappend:RDEPENDS:${PN}-inventory:append:palmetto = " openpower-occ-control phosphor-webui"
> meta-ibm/meta-romulus/recipes-phosphor/packagegroups/packagegroup-obmc-apps.bbappend:RDEPENDS:${PN}-extras:append:romulus = " phosphor-webui phosphor-image-signing"
> meta-ibm/recipes-phosphor/packagegroups/packagegroup-obmc-apps.bbappend:RDEPENDS:${PN}-extras:append:ibm-ac-server = " ${POWER_SERVICE_PACKAGES_AC_SERVER} witherspoon-power-supply-sync phosphor-webui"
> meta-ibm/recipes-phosphor/packagegroups/packagegroup-obmc-apps.bbappend:RDEPENDS:${PN}-extras:append:mihawk = " phosphor-webui phosphor-image-signing wistron-ipmi-oem ${POWER_SERVICE_PACKAGES_AC_SERVER}"
> meta-ibm/recipes-phosphor/packagegroups/packagegroup-obmc-apps.bbappend:RDEPENDS:${PN}-extras:remove:witherspoon-tacoma = "obmc-ikvm liberation-fonts uart-render-controller phosphor-webui"
> meta-inspur/meta-on5263m5/recipes-inspur/packagegroups/packagegroup-inspur-apps.bb:        phosphor-webui \
> meta-intel-openbmc/meta-common/recipes-intel/packagegroups/packagegroup-intel-apps.bb:        phosphor-webui \
> meta-lenovo/meta-common/recipes-lenovo/packagegroups/packagegroup-lenovo-apps.bb:        phosphor-webui \
> meta-quanta/meta-olympus-nuvoton/recipes-olympus-nuvoton/packagegroups/packagegroup-olympus-nuvoton-apps.bb:        phosphor-webui \
> meta-supermicro/meta-common/recipes-supermicro/packagegroups/packagegroup-supermicro-apps.bb:        phosphor-webui \
> ```
>

I suspect we should put together a patch to leave rest-dbus this
enabled for the above systems at the same time we change the default.
With that said, based on Patricks other email, a lot of them are
slated to be obsoleted anyway, so maybe the problem will solve itself?

I wonder if there's some clever yocto way we could just turn
phosphor-webui into a distro feature, and flip the bmcweb flag on
automatically?

> Romulus and Palmetto at least are ones we utilize in CI.
>
> Is whatever hardware testing we do on Witherspoon now moved over to the Redfish
> APIs?  Everything in openbmc-test-automation.
>
> --
> Patrick Williams

Re: Turning off the D-Bus REST API by default

[Ali Ahmed]

[-- Attachment #1: Type: text/plain, Size: 982 bytes --]

Hey Igor,

Yes, but we are currently working to merge TPM Policy into bmcweb, and then
webui-vue can move over to using Redfish for this property.
You can see the review status here:
https://gerrit.openbmc-project.xyz/c/openbmc/bmcweb/+/44044.

Ed if you get a chance can you take a look at this review?


On Thu, Aug 12, 2021 at 3:31 PM i.kononenko <i.kononenko@yadro.com> wrote:

> Ali,
>
> On 12.08.2021 17:10, Ali Ahmed wrote:
>
> > After this commit to use phosphor-webui or D-Bus REST, you will need
> > to set -Drest=enabled in your bbappend. Note: webui-vue uses Redfish
> > and will not be impacted. Let me know if you have any concerns.
>
> As far I knew, the webui-vue uses REST API to retrieve the TPM status.
> Please, look to the link below [1]
>
> Links:
> [1]
> https://github.com/openbmc/webui-vue/blob/6dba4be6125c10210bafa030ac17737d3a9b28b8/src/store/modules/Operations/BootSettingsStore.js#L73
> >
> > -Ali Ahmed
> >
>
> --
> Best regards,
>
> Igor Kononenko
>

[-- Attachment #2: Type: text/html, Size: 1726 bytes --]

Re: Turning off the D-Bus REST API by default

[Gunnar Mills]

On 8/12/2021 2:41 PM, Ed Tanous wrote:
> On Thu, Aug 12, 2021 at 1:32 PM i.kononenko <i.kononenko@yadro.com> wrote:
>>
>> Ali,
>>
>> On 12.08.2021 17:10, Ali Ahmed wrote:
>>
>>> After this commit to use phosphor-webui or D-Bus REST, you will need
>>> to set -Drest=enabled in your bbappend. Note: webui-vue uses Redfish
>>> and will not be impacted. Let me know if you have any concerns.
>>
>> As far I knew, the webui-vue uses REST API to retrieve the TPM status.
>> Please, look to the link below [1]
> 
> @gunnar @derick  isn't this against one of the primary design goals of
> webui-vue?  Was it intentionally merged?  It seems like having
> webui-vue rely on dbus-rest just keeps digging the hole deeper on this
> initial thing, which is getting dbus-rest disabled by default.
> 

I think when this was merged 2 years ago, when webui-vue was still very 
very young, the thinking was we will switch to Redfish when TPMenable is 
implemented in Redfish and there was value to having a working page. 
This does go against a core design goal of webui-vue.  I certainly would 
-1 any commit trying to add D-Bus REST API to webui-vue today. I think 
this is just a TODO that hasn't been implemented.
https://github.com/openbmc/webui-vue/blame/6dba4be6125c10210bafa030ac17737d3a9b28b8/src/store/modules/Operations/BootSettingsStore.js#L74

GET TrustedModuleRequiredToBoot is available today. The PATCH is in 
review here: https://gerrit.openbmc-project.xyz/c/openbmc/bmcweb/+/44044

We will push a commit to switch this to Redfish.

Re: Turning off the D-Bus REST API by default

[Ed Tanous]

On Fri, Aug 13, 2021 at 9:05 AM Gunnar Mills <gmills@linux.vnet.ibm.com> wrote:
>
> On 8/12/2021 2:41 PM, Ed Tanous wrote:
> > On Thu, Aug 12, 2021 at 1:32 PM i.kononenko <i.kononenko@yadro.com> wrote:
> >>
> >> Ali,
> >>
> >> On 12.08.2021 17:10, Ali Ahmed wrote:
> >>
> >>> After this commit to use phosphor-webui or D-Bus REST, you will need
> >>> to set -Drest=enabled in your bbappend. Note: webui-vue uses Redfish
> >>> and will not be impacted. Let me know if you have any concerns.
> >>
> >> As far I knew, the webui-vue uses REST API to retrieve the TPM status.
> >> Please, look to the link below [1]
> >
> > @gunnar @derick  isn't this against one of the primary design goals of
> > webui-vue?  Was it intentionally merged?  It seems like having
> > webui-vue rely on dbus-rest just keeps digging the hole deeper on this
> > initial thing, which is getting dbus-rest disabled by default.
> >
>
> I think when this was merged 2 years ago, when webui-vue was still very
> very young, the thinking was we will switch to Redfish when TPMenable is
> implemented in Redfish and there was value to having a working page.
> This does go against a core design goal of webui-vue.  I certainly would
> -1 any commit trying to add D-Bus REST API to webui-vue today. I think
> this is just a TODO that hasn't been implemented.
> https://github.com/openbmc/webui-vue/blame/6dba4be6125c10210bafa030ac17737d3a9b28b8/src/store/modules/Operations/BootSettingsStore.js#L74

Makes sense.  I didn't realize it was so old;  Thanks for the info Gunnar.

>
> GET TrustedModuleRequiredToBoot is available today. The PATCH is in
> review here: https://gerrit.openbmc-project.xyz/c/openbmc/bmcweb/+/44044
>
> We will push a commit to switch this to Redfish.