summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorLans Zhang <jia.zhang@windriver.com>2017-07-11 14:08:45 +0800
committerLans Zhang <jia.zhang@windriver.com>2017-07-11 14:08:45 +0800
commit473d7cf3fdaa013905c3f5a879ab27f0d70affb8 (patch)
tree0c15e36fadb52dde5cab32a51337f22073e5e05c
parent0f3911c740bb74f5b3783adee76ebf4b02be8c76 (diff)
downloadmeta-secure-core-473d7cf3fdaa013905c3f5a879ab27f0d70affb8.tar.gz
README: cleanup
Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
-rw-r--r--README.md26
1 files changed, 2 insertions, 24 deletions
diff --git a/README.md b/README.md
index 8cc9f32..d476328 100644
--- a/README.md
+++ b/README.md
@@ -1,4 +1,4 @@
1### meta-secure-env 1### meta-secure-core
2This layer provides the following common and platform-specific security 2This layer provides the following common and platform-specific security
3features: 3features:
4 4
@@ -9,32 +9,22 @@ key. Whenever this feature is enabled, the bootloader and kernel will be
9signed automatically during the build, implying the signed binaries are 9signed automatically during the build, implying the signed binaries are
10contained by the resulting RPM and rootfs image. 10contained by the resulting RPM and rootfs image.
11 11
12Refer to [meta-efi-secure-boot](https://github.com/jiazhang0/meta-efi-secure-boot/blob/master/README.md) for more details.
13
14#### MOK Secure Boot 12#### MOK Secure Boot
15For x86 platform, MOK secure boot is based on the UEFI secure boot, adding 13For x86 platform, MOK secure boot is based on the UEFI secure boot, adding
16the shim loader to chainloader the second-stage bootloader. Meanwhile, 14the shim loader to chainloader the second-stage bootloader. Meanwhile,
17the shim will also install a protocol which permits the second-stage bootloader 15the shim will also install a protocol which permits the second-stage bootloader
18to perform similar binary validation, e.g, for linux kernel. 16to perform similar binary validation, e.g, for linux kernel.
19 17
20Refer to [meta-efi-secure-boot](https://github.com/jiazhang0/meta-efi-secure-boot/blob/master/README.md) for more details.
21
22#### User key store 18#### User key store
23By default, the signing key used by UEFI/MOK secure boot is the sample key for 19By default, the signing key used by UEFI/MOK secure boot is the sample key for
24the purposes of development and demonstration. It is not recommended that 20the purposes of development and demonstration. It is not recommended that
25this sample key be used for a production device and should be replaced by 21this sample key be used for a production device and should be replaced by
26a secret key owned by the user. 22a secret key owned by the user.
27 23
28Refer to [meta-signing-key](https://github.com/jiazhang0/meta-signing-key/blob/master/README.md)
29for more details about how to construct an user key store.
30
31#### TPM 1.x 24#### TPM 1.x
32This feature enables Trusted Platform Module 1.x support, including 25This feature enables Trusted Platform Module 1.x support, including
33kernel option changes to enable tpm drivers, and picking up TPM 1.x packages. 26kernel option changes to enable tpm drivers, and picking up TPM 1.x packages.
34 27
35Refer to [meta-tpm](https://github.com/jiazhang0/meta-tpm/blob/master/README.md)
36for more details.
37
38#### TPM 2.0 28#### TPM 2.0
39This feature enables Trusted Platform Module 2.0 support, including 29This feature enables Trusted Platform Module 2.0 support, including
40kernel option changes to enable tpm drivers, and picking up TPM 2.0 packages. 30kernel option changes to enable tpm drivers, and picking up TPM 2.0 packages.
@@ -43,9 +33,6 @@ Trusted Platform Module (TPM 2.0) is a microcontroller that stores keys,
43passwords, and digital certificates. A discrete TPM 2.0 offers the 33passwords, and digital certificates. A discrete TPM 2.0 offers the
44capabilities as part of the overall platform security requirements. 34capabilities as part of the overall platform security requirements.
45 35
46Refer to [meta-tpm2](https://github.com/jiazhang0/meta-tpm2/blob/master/README.md)
47for more details.
48
49#### Encrypted storage 36#### Encrypted storage
50This feature gives 2 types of granularity for storage encryption. Data volume 37This feature gives 2 types of granularity for storage encryption. Data volume
51encryption allows the user to create encryption partition with a passphrase 38encryption allows the user to create encryption partition with a passphrase
@@ -57,8 +44,6 @@ which provides transparent encryption of block devices using the kernel crypto
57API. Additionally, the utility cryptsetup is used to conveniently setup disk 44API. Additionally, the utility cryptsetup is used to conveniently setup disk
58encryption based on device-mapper crypt target. 45encryption based on device-mapper crypt target.
59 46
60Refer to [meta-encrypted-storage](https://github.com/jiazhang0/meta-encrypted-storage/blob/master/README.md) for more details.
61
62#### Integrity 47#### Integrity
63The Linux IMA subsystem introduces hooks within the Linux kernel to support 48The Linux IMA subsystem introduces hooks within the Linux kernel to support
64measuring the integrity of files that are loaded (including application code) 49measuring the integrity of files that are loaded (including application code)
@@ -80,16 +65,9 @@ files and applications to be loaded if the hashes match (and will save the
80updated hash if the file is modified) but refuse to load it if it doesn't. This 65updated hash if the file is modified) but refuse to load it if it doesn't. This
81provides some protection against offline tampering of the files. 66provides some protection against offline tampering of the files.
82 67
83Refer to [meta-integrity](https://github.com/jiazhang0/meta-efi-secure-boot/blob/master/README.md)
84for more details.
85
86#### RPM signing 68#### RPM signing
87This feature provides the integrity verification for the RPM5 package. 69This feature provides the integrity verification for the RPM5 package.
88 70
89Refer to [meta-rpm-signing](https://github.com/jiazhang0/meta-rpm-signing/blob/master/README.md) 71### Building the meta-secure-core layer
90for more details.
91
92
93### Building the meta-secure-env layer
94This layer should be added to the bblayers.conf file. To enable certain 72This layer should be added to the bblayers.conf file. To enable certain
95feature provided by this layer, add the feature to the local.conf file. 73feature provided by this layer, add the feature to the local.conf file.