Commit Graph

23 Commits

Author SHA1 Message Date
Richard Hughes
8b63023aaf Only show *changed* events in the fwupdmgr security output
We do not want to show added or removed HSI tests in this UI.
2022-08-24 13:19:17 +01:00
Richard Hughes
62fc515714 Allow loading in emulated host profiles for debugging
This allows us to load sets of different host security attributes
for testing the various front end tools we have now. e.g.

    sudo FWUPD_HOST_EMULATE=thinkpad-p1-iommu.json.gz fwupd

or, using a non-compressed absolute path:

    sudo FWUPD_HOST_EMULATE=/tmp/test/thinkpad-p1-iommu.json fwupd

Data can be created with `./contrib/generate-emulation.py file.json`
and then can be manually modified if required. Running the script on
a file that already exists will just strip out any unneeded data, as
well as piping content into it using stdin.

As a precaution, the org.fwupd.hsi.HostEmulation attribute is added
so we do not ask the user to upload the HSI report. It also allows
the LVFS to ignore any HSI reports with this attribute for clients
that upload HSI reports regardless.

See https://github.com/fwupd/fwupd/discussions/4832
2022-07-18 16:27:59 +01:00
Richard Hughes
3e0a4dc1c3 Be smarter and include less header files per source file 2022-06-14 14:36:52 -05:00
Mario Limonciello
7526d1b183 Add a new attribute for fused platform
Fused parts are unable to be tampered with.
2022-04-12 10:39:02 -05:00
Mario Limonciello
0e3e8ff610 trivial: change Intel debug attributes to generic
As other platforms have features with the same attribute, remove
the Intel generic one.
2022-04-12 10:39:02 -05:00
Mario Limonciello
9adb5380b3 Add a new HSI attributes for SPI protections 2022-04-12 10:39:02 -05:00
Mario Limonciello
04efb0b0cb Add a new HSI attribute for AMD rollback protection
This will be used by an upcoming AMD plugin
2022-04-12 10:39:02 -05:00
Richard Hughes
06ddcc413a trivial: Fix a docgen warning on release build 2022-04-04 13:05:19 +01:00
Mario Limonciello
26349d0f28 cpu: Add a new attribute for CPU supported by HSI
On supported CPUs this will show up at HSI level 1 meaning that HSI
should be supported and trusted on this CPU if all plugins provided
enough data.

On non-Intel CPUs this will show up as missing data, meaning
that not enough plugins provide data for HSI to be trusted by default.
2022-04-03 09:06:00 -05:00
Mario Limonciello
a93feda72b trivial: rename the DMAR attribute to be vendor agnostic
The DMAR attribute is for Intel only, but AMD has the same feature in
the IVRS table.  Rename the attribute to clarify this.
2022-04-03 09:05:49 -05:00
Gabriel Kerneis
3e8f09a0f7 Add HSI check that PCR registers 0-7 are not empty
Some BIOSes forget add measurements to PCR registers, which results in
all-zero checksums and breaks measured boot guarantees.

Fixes #3901
2021-11-17 16:21:52 +00:00
Richard Hughes
8120616c62 trivial: Add a fallback result for an HSI attribute
The fallback may represent the old state, or a state
that may be considered equivalent.
2021-11-01 06:58:44 +00:00
Richard Hughes
e9319699b4 trivial: Add fwupd_security_attr_copy() for future functionality 2021-10-29 13:09:45 +01:00
Richard Hughes
dbdd3740a3 Add support for loading the HSI result from a JSON blob
This is how we save it to the database, and we'll need to load old
records for future functionality.
2021-10-28 15:36:13 +01:00
Mario Limonciello
55de39c077 trivial: reformat the whole tree to match new format 2021-08-24 11:18:40 -05:00
Richard Hughes
8b0031fad3 trivial: Codespell fixes 2021-06-15 21:45:15 +01:00
Richard Hughes
a02c1073f2 trivial: Fix up some of the developer docs
And add some missing content as requried.
2021-06-11 09:39:03 +01:00
Mario Limonciello
3f016787ee trivial: add gtkdoc for more of the defines 2021-06-04 13:21:41 -05:00
Mario Limonciello
1f9c035788 trivial: fix some trailing whitespace problems across the project 2021-04-09 16:02:20 +01:00
Richard Hughes
f3c64adb6c intel-spi: Allow downloading the firmware image from the eSPI controller
Add the IFD regions as child devices and set the region access on the child
devices. Also add read-only SPI descriptor as an HSI attribute and require
FLOCKDN on Intel hardware.

Use the hidden PCI 00:1f.5 device to set the SPIBAR automatically and generate
the quirk file automatically to support more hardware.
2021-04-01 21:56:35 +01:00
Richard Hughes
104459bd10 Check the AMI test key if not installed for HSI-1
Fixes https://github.com/fwupd/fwupd/issues/2695
2021-01-05 17:09:02 +00:00
Richard Hughes
f4c206d319 libfwupd: Do not export the HSI AppStream IDs
The clients don't need to know this, and exporting them means we paint-ourselves
into a corner if we want to change the 'namespace' or how HSI actually works.
2020-10-08 16:36:56 +01:00
Richard Hughes
173acd2e07 Add FwupdSecurityAttr to libfwupd
This will be used to store security attributes about platform security.
2020-05-11 17:52:41 +01:00