Please help as I am confused.
I implemented verified boot on 2014.04 using CONFIG_OF_SEPARATE and it works fine with FIT images. However it still boots the resident legacy kernal that has not been signed.
This means that anyone wishing to circumvent the signed hash can do so by replacing the image file with a legacy one. That makes for a security hole and so I must have done something wrong.
When I look at function bootm_find_os() from file cmd_bootm.c its switch statement provides this behaviour -
case IMAGE_FORMAT_LEGACY: cool, its a go from me. Verify using an unsigned hash. break; #if defined(CONFIG_FIT) case IMAGE_FORMAT_FIT: do the signed hash checks when loading the image. break;
What I cannot find in the code is anything that I can compile in to prevent an unsigned legacy kernel from booting. The defines I already used include
#define CONFIG_OF_LIBFDT #define CONFIG_CMD_HASH #define CONFIG_HASH_VERIFY #define CONFIG_FIT_SIGNATURE #define CONFIG_RSA
Thanks,
Mike.