diff options
author | Lans Zhang <jia.zhang@windriver.com> | 2017-07-11 14:08:45 +0800 |
---|---|---|
committer | Lans Zhang <jia.zhang@windriver.com> | 2017-07-11 14:08:45 +0800 |
commit | 473d7cf3fdaa013905c3f5a879ab27f0d70affb8 (patch) | |
tree | 0c15e36fadb52dde5cab32a51337f22073e5e05c | |
parent | 0f3911c740bb74f5b3783adee76ebf4b02be8c76 (diff) | |
download | meta-secure-core-473d7cf3fdaa013905c3f5a879ab27f0d70affb8.tar.gz |
README: cleanup
Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
-rw-r--r-- | README.md | 26 |
1 files changed, 2 insertions, 24 deletions
@@ -1,4 +1,4 @@ | |||
1 | ### meta-secure-env | 1 | ### meta-secure-core |
2 | This layer provides the following common and platform-specific security | 2 | This layer provides the following common and platform-specific security |
3 | features: | 3 | features: |
4 | 4 | ||
@@ -9,32 +9,22 @@ key. Whenever this feature is enabled, the bootloader and kernel will be | |||
9 | signed automatically during the build, implying the signed binaries are | 9 | signed automatically during the build, implying the signed binaries are |
10 | contained by the resulting RPM and rootfs image. | 10 | contained by the resulting RPM and rootfs image. |
11 | 11 | ||
12 | Refer to [meta-efi-secure-boot](https://github.com/jiazhang0/meta-efi-secure-boot/blob/master/README.md) for more details. | ||
13 | |||
14 | #### MOK Secure Boot | 12 | #### MOK Secure Boot |
15 | For x86 platform, MOK secure boot is based on the UEFI secure boot, adding | 13 | For x86 platform, MOK secure boot is based on the UEFI secure boot, adding |
16 | the shim loader to chainloader the second-stage bootloader. Meanwhile, | 14 | the shim loader to chainloader the second-stage bootloader. Meanwhile, |
17 | the shim will also install a protocol which permits the second-stage bootloader | 15 | the shim will also install a protocol which permits the second-stage bootloader |
18 | to perform similar binary validation, e.g, for linux kernel. | 16 | to perform similar binary validation, e.g, for linux kernel. |
19 | 17 | ||
20 | Refer to [meta-efi-secure-boot](https://github.com/jiazhang0/meta-efi-secure-boot/blob/master/README.md) for more details. | ||
21 | |||
22 | #### User key store | 18 | #### User key store |
23 | By default, the signing key used by UEFI/MOK secure boot is the sample key for | 19 | By default, the signing key used by UEFI/MOK secure boot is the sample key for |
24 | the purposes of development and demonstration. It is not recommended that | 20 | the purposes of development and demonstration. It is not recommended that |
25 | this sample key be used for a production device and should be replaced by | 21 | this sample key be used for a production device and should be replaced by |
26 | a secret key owned by the user. | 22 | a secret key owned by the user. |
27 | 23 | ||
28 | Refer to [meta-signing-key](https://github.com/jiazhang0/meta-signing-key/blob/master/README.md) | ||
29 | for more details about how to construct an user key store. | ||
30 | |||
31 | #### TPM 1.x | 24 | #### TPM 1.x |
32 | This feature enables Trusted Platform Module 1.x support, including | 25 | This feature enables Trusted Platform Module 1.x support, including |
33 | kernel option changes to enable tpm drivers, and picking up TPM 1.x packages. | 26 | kernel option changes to enable tpm drivers, and picking up TPM 1.x packages. |
34 | 27 | ||
35 | Refer to [meta-tpm](https://github.com/jiazhang0/meta-tpm/blob/master/README.md) | ||
36 | for more details. | ||
37 | |||
38 | #### TPM 2.0 | 28 | #### TPM 2.0 |
39 | This feature enables Trusted Platform Module 2.0 support, including | 29 | This feature enables Trusted Platform Module 2.0 support, including |
40 | kernel option changes to enable tpm drivers, and picking up TPM 2.0 packages. | 30 | kernel option changes to enable tpm drivers, and picking up TPM 2.0 packages. |
@@ -43,9 +33,6 @@ Trusted Platform Module (TPM 2.0) is a microcontroller that stores keys, | |||
43 | passwords, and digital certificates. A discrete TPM 2.0 offers the | 33 | passwords, and digital certificates. A discrete TPM 2.0 offers the |
44 | capabilities as part of the overall platform security requirements. | 34 | capabilities as part of the overall platform security requirements. |
45 | 35 | ||
46 | Refer to [meta-tpm2](https://github.com/jiazhang0/meta-tpm2/blob/master/README.md) | ||
47 | for more details. | ||
48 | |||
49 | #### Encrypted storage | 36 | #### Encrypted storage |
50 | This feature gives 2 types of granularity for storage encryption. Data volume | 37 | This feature gives 2 types of granularity for storage encryption. Data volume |
51 | encryption allows the user to create encryption partition with a passphrase | 38 | encryption allows the user to create encryption partition with a passphrase |
@@ -57,8 +44,6 @@ which provides transparent encryption of block devices using the kernel crypto | |||
57 | API. Additionally, the utility cryptsetup is used to conveniently setup disk | 44 | API. Additionally, the utility cryptsetup is used to conveniently setup disk |
58 | encryption based on device-mapper crypt target. | 45 | encryption based on device-mapper crypt target. |
59 | 46 | ||
60 | Refer to [meta-encrypted-storage](https://github.com/jiazhang0/meta-encrypted-storage/blob/master/README.md) for more details. | ||
61 | |||
62 | #### Integrity | 47 | #### Integrity |
63 | The Linux IMA subsystem introduces hooks within the Linux kernel to support | 48 | The Linux IMA subsystem introduces hooks within the Linux kernel to support |
64 | measuring the integrity of files that are loaded (including application code) | 49 | measuring the integrity of files that are loaded (including application code) |
@@ -80,16 +65,9 @@ files and applications to be loaded if the hashes match (and will save the | |||
80 | updated hash if the file is modified) but refuse to load it if it doesn't. This | 65 | updated hash if the file is modified) but refuse to load it if it doesn't. This |
81 | provides some protection against offline tampering of the files. | 66 | provides some protection against offline tampering of the files. |
82 | 67 | ||
83 | Refer to [meta-integrity](https://github.com/jiazhang0/meta-efi-secure-boot/blob/master/README.md) | ||
84 | for more details. | ||
85 | |||
86 | #### RPM signing | 68 | #### RPM signing |
87 | This feature provides the integrity verification for the RPM5 package. | 69 | This feature provides the integrity verification for the RPM5 package. |
88 | 70 | ||
89 | Refer to [meta-rpm-signing](https://github.com/jiazhang0/meta-rpm-signing/blob/master/README.md) | 71 | ### Building the meta-secure-core layer |
90 | for more details. | ||
91 | |||
92 | |||
93 | ### Building the meta-secure-env layer | ||
94 | This layer should be added to the bblayers.conf file. To enable certain | 72 | This layer should be added to the bblayers.conf file. To enable certain |
95 | feature provided by this layer, add the feature to the local.conf file. | 73 | feature provided by this layer, add the feature to the local.conf file. |