summaryrefslogtreecommitdiffstats
path: root/docs/1_Architecture_Guides/1.2_Security_Blueprint/2_Secure_Boot/1.2.2.2_Communication-modes.md
diff options
context:
space:
mode:
authorgrowupboron <shankhoghosh123@gmail.com>2020-09-11 17:18:57 +0530
committerJan-Simon Moeller <jsmoeller@linuxfoundation.org>2020-09-11 12:11:56 +0000
commit4aad369c9728061c97b3de792286e743ee884b09 (patch)
tree14bddddeab334e3fdbdcf29446a87aa11cf6cd97 /docs/1_Architecture_Guides/1.2_Security_Blueprint/2_Secure_Boot/1.2.2.2_Communication-modes.md
parent619a7e48085be1538c3b01eb93dcb9dc95bf0436 (diff)
Simplified doc-site generationjellyfish_9.99.4jellyfish/9.99.49.99.4
Updated theme to windmill Using Mkdocs static site generator Deployed on readthedocs Signed-off-by: growupboron <shankhoghosh123@gmail.com> Change-Id: If62eaaea1855c91b64f687900f54eba6bc1caee8 Reviewed-on: https://gerrit.automotivelinux.org/gerrit/c/AGL/documentation/+/25236 Reviewed-by: Jan-Simon Moeller <jsmoeller@linuxfoundation.org> Tested-by: Jan-Simon Moeller <jsmoeller@linuxfoundation.org>
Diffstat (limited to 'docs/1_Architecture_Guides/1.2_Security_Blueprint/2_Secure_Boot/1.2.2.2_Communication-modes.md')
-rw-r--r--docs/1_Architecture_Guides/1.2_Security_Blueprint/2_Secure_Boot/1.2.2.2_Communication-modes.md98
1 files changed, 98 insertions, 0 deletions
diff --git a/docs/1_Architecture_Guides/1.2_Security_Blueprint/2_Secure_Boot/1.2.2.2_Communication-modes.md b/docs/1_Architecture_Guides/1.2_Security_Blueprint/2_Secure_Boot/1.2.2.2_Communication-modes.md
new file mode 100644
index 0000000..3381324
--- /dev/null
+++ b/docs/1_Architecture_Guides/1.2_Security_Blueprint/2_Secure_Boot/1.2.2.2_Communication-modes.md
@@ -0,0 +1,98 @@
+---
+edit_link: ''
+title: Communication modes
+origin_url: >-
+ https://raw.githubusercontent.com/automotive-grade-linux/docs-sources/master/docs/security-blueprint/part-2/2-Communication-modes.md
+---
+
+<!-- WARNING: This file is generated by fetch_docs.js using /home/boron/Documents/AGL/docs-webtemplate/site/_data/tocs/architecture/master/security_blueprint-security-blueprint-book.yml -->
+
+# Communication modes
+
+## Disable USB, Serial and DOCSIS Support
+
+To disable USB support in U-Boot, following config's shall not be defined:
+
+```
+CONFIG_CMD_USB: Enables basic USB support and the usb command.
+CONFIG_USB_UHCI: Defines the lowlevel part.
+CONFIG_USB_KEYBOARD: Enables the USB Keyboard.
+CONFIG_USB_STORAGE: Enables the USB storage devices.
+CONFIG_USB_HOST_ETHER: Enables USB Ethernet adapter support.
+```
+
+In addition, disable unnecessary communication modes like Ethernet, Serial
+ports, DOCSIS in U-Boot and sboot that are not necessary.
+
+Linux Kernel support for USB should be compiled-out if not required. If it is
+needed, the Linux Kernel should be configured to only enable the minimum
+required USB devices. User-initiated USB-filesystems should be treated with
+special care. Whether or not the filesystems are mounted in userspace
+(**FUSE**), restricted mount options should be observed.
+
+<!-- section-config -->
+
+Domain | Communication modes | _State_
+-------------------- | ------------------------- | --------------------------------------------------------------------------------------------------------------------------------------
+Boot-Communication-1 | `USB` | _Disabled_ and _Compiled-out_ if not required.
+Boot-Communication-2 | `USB` | Else, Kernel should be configured to only enable the minimum required USB devices and filesystems should be treated with special care.
+Boot-Communication-3 | `Ethernet` | _Disabled_
+Boot-Communication-4 | U-boot and sboot `DOCSIS` | _Disabled_
+Boot-Communication-5 | `Serial ports` | _Disabled_
+
+<!-- end-section-config --> <!-- section-config -->
+
+Domain | `Config` name | _State_
+------------------------ | ----------------------- | -------------
+Boot-Communication-USB-1 | `CONFIG_CMD_USB` | _Not defined_
+Boot-Communication-USB-2 | `CONFIG_USB_UHCI` | _Not defined_
+Boot-Communication-USB-3 | `CONFIG_USB_KEYBOARD` | _Not defined_
+Boot-Communication-USB-4 | `CONFIG_USB_STORAGE` | _Not defined_
+Boot-Communication-USB-5 | `CONFIG_USB_HOST_ETHER` | _Not defined_
+
+<!-- end-section-config -->
+
+--------------------------------------------------------------------------------
+
+## Disable all unused Network Interfaces
+
+Only used network interfaces should be enabled.
+Where possible, services should also be limited to those necessary.
+
+<!-- section-config -->
+
+Domain | Communication modes | _State_
+-------------------- | -------------------- | ---------------------------------------------------------------------------------------------
+Boot-Communication-1 | `Network interfaces` | Preferably _no network interface is allowed_, otherwise, restrict the services to those used.
+
+<!-- end-section-config -->
+
+## Remove or Disable Unnecessary Services, Ports, and Devices
+
+Restrict the `services`, `ports` and `devices` to those used.
+
+<!-- section-config -->
+
+Domain | Object | Recommendations
+-------------------- | --------------------------------- | -------------------------------------------------------------
+Boot-Communication-1 | `Services`, `ports` and `devices` | Restrict the `services`, `ports` and `devices` to those used.
+
+<!-- end-section-config -->
+
+## Disable flash access
+
+**Recommendation**:
+
+In U-Boot following flash memory commands shall be disabled:
+
+**NAND**: Support for nand flash access available through `do_nand` has to be disabled.
+
+<!-- section-config -->
+
+Domain | `Command` name | _State_
+-------------------------- | -------------- | ---------
+Boot-Communication-Flash-1 | `do_nand` | _Disable_
+
+<!-- end-section-config -->
+
+Similarly sboot should disable flash access support through command line if any.