Commit Graph

30 Commits

Author SHA1 Message Date
Mario Limonciello
b7b0ce533d trivial: Unify ambiguity between bios-attrs and bios-settings
These are currently used interchangeably since there was indecisiveness
which to use as the feature was being developed.

As outward facing it will be named with "settings", change all uses
in the code to match this.
2022-08-24 07:20:01 -05:00
Richard Hughes
8b63023aaf Only show *changed* events in the fwupdmgr security output
We do not want to show added or removed HSI tests in this UI.
2022-08-24 13:19:17 +01:00
Richard Hughes
0beed2f138 Store the current BIOS value in a security attribute
We can't very-well ask the user to 'change it back' if we do not tell
them what it is set to already.
2022-08-01 15:45:43 +01:00
Richard Hughes
77006b75eb Set the target value on the security attribute
Semantically it is the desire of the security attribute, not the bios
attribute, i.e. you could imagine that a specific attribute would have
to be *foo or bar or baz* for HSI-1 and *only foo* for HSI-2

Also make it easier to add possible BIOS attribute target values in
plugin code.
2022-08-01 07:12:18 +01:00
Mario Limonciello
331d7bbd40 trivial: FwupdSecurityAttr: fix a symbol name 2022-07-29 12:41:59 -05:00
Mario Limonciello
aa1e321f6e Add support for including a FwupdBiosAttr ID in FwupdSecurityAttr
This can allow clients to let users correct problems found on their
systems.
2022-07-29 11:31:50 -05:00
Richard Hughes
26e5ecb567 trivial: Add fwupd_security_attr_remove_flag() for future use 2022-07-14 14:48:51 +01:00
Richard Hughes
ae0c3fe38a Add 'action' resolution flags to each FwupdSecurityAttr
We tried to solve this by matching the org.fwupd.hsi AppStream ID, but
in some cases the resolution depends on what actually failed.

Add "the action the user is supposed to do" as flags so that the
front-end can translate this in the appropriate way, for instance,
using a different string for log events and HSI dialogs.
2022-07-14 14:47:44 +01:00
Richard Hughes
1ef23d1006 Add some FwupdSecurityAttr API for future use 2022-07-09 20:58:19 +01:00
Mario Limonciello
2f086c2bbc Add a new security attribute flag of "missing data"
This attribute flag will be used to determine whether or not enough
data has been provided to make a security level calculation.
2022-04-03 09:06:00 -05:00
Richard Hughes
a085b4dd68 Add a 'created' property on the HSI security attribute 2021-10-28 17:25:40 +01:00
Richard Hughes
95b82a1467 trivial: Add two missing _from_string() HSI helpers 2021-10-28 15:36:13 +01:00
Richard Hughes
f56878ff88 Allow adding GUIDs to each HSI security attr
This indicates the GUID in some way contributed to the result decided.

It also allows us to match the submitted HSI results back to a firmware
stream on the LVFS, which allows us to allow vendors to see a subset of
results for uploaded devices.
2021-09-03 22:03:28 +01:00
Mario Limonciello
55de39c077 trivial: reformat the whole tree to match new format 2021-08-24 11:18:40 -05:00
Richard Hughes
f4c206d319 libfwupd: Do not export the HSI AppStream IDs
The clients don't need to know this, and exporting them means we paint-ourselves
into a corner if we want to change the 'namespace' or how HSI actually works.
2020-10-08 16:36:56 +01:00
Mario Limonciello
82c3e3471d Remove support for UEFI dbx security attribute
This is no longer relevant as fwupd is providing dbxtool now.
2020-08-19 07:38:51 +01:00
Richard Hughes
fd0ee5153e Add some of the HSI specification to the generated documentation 2020-08-17 20:23:49 +01:00
Richard Hughes
cad96542e2 Check if CET is actually being used on the runtime system
With thanks to H.J. Lu <hjl.tools@gmail.com> for the initial code.
2020-07-27 15:53:38 +01:00
Richard Hughes
30f7ffbdbd pci-mei: Split up the bootguard HSI checks into multiple entries
Additionally, demote the error policy to HSI-3 and do not show the other
failures if BootGuard is disabled.

Fixes https://github.com/fwupd/fwupd/issues/2265
2020-07-20 22:50:31 +01:00
Richard Hughes
474d1442f1 trivial: Use proper AppStream namespacing for HSI attributes 2020-07-20 22:50:31 +01:00
Richard Hughes
9a04ce8f29 msr: Add a new plugin to detect the Intel DCI state 2020-07-16 20:13:06 +01:00
Richard Hughes
6269a839eb Add a security attribute for BootGuard
This information is obtained from the MEI configuration space.
2020-07-02 20:25:48 +01:00
Richard Hughes
7b57ce226b libfwupd: Allow storing metadata on the security attr 2020-07-01 20:10:39 +01:00
Richard Hughes
0f6d754d5a Detect if the MEI device has known security issues
If it has, fail HSI-1.
2020-06-01 22:49:39 +01:00
Richard Hughes
bb228cbe53 pci-mei: Check the HFS register for the override strap 2020-05-29 17:34:18 +01:00
Mario Limonciello
bb6b1a8693 Revert "amt: Add a security attestation for provisioning"
This reverts commit f160e6b7fc.
2020-05-22 15:13:19 +01:00
Richard Hughes
c821923668 Add an HSI attribute for Intel SMAP
See https://en.wikipedia.org/wiki/Supervisor_Mode_Access_Prevention for details.
2020-05-22 07:26:47 +01:00
Richard Hughes
b246bcaecb Allow client tools to translate the HSI attributes and results
To do this, rely on the AppStream ID to map to a translated string (providing a
fallback for clients that do not care) and switch the free-form result string
into a set of enumerated values that can be translated.

This fixes some of the problems where some things have to be enabled to "pass"
and other attributes have to be some other state. For cases where we want the
user to "do" something, provide a URL to a wiki page that we update out-of-band
of fwupd releases.
2020-05-18 17:03:49 +01:00
Richard Hughes
cae111d1de Save the plugin that created the FwupdSecurityAttr
This is really useful for debugging.
2020-05-15 16:17:27 +01:00
Richard Hughes
173acd2e07 Add FwupdSecurityAttr to libfwupd
This will be used to store security attributes about platform security.
2020-05-11 17:52:41 +01:00