build.sh: sdk_run: Use :Z to relabel volumes attached to docker - #750
Open
philipanda wants to merge 881 commits into
Open
build.sh: sdk_run: Use :Z to relabel volumes attached to docker#750philipanda wants to merge 881 commits into
:Z to relabel volumes attached to docker#750philipanda wants to merge 881 commits into
Conversation
Upstream-Status: Inappropriate [Dasharo downstream] Change-Id: I0a5650de8da73a9fe168457c0cfe817a6e6fd0be Signed-off-by: Filip Lewiński <filip.lewinski@3mdeb.com>
Change-Id: I09e700bacd0187ef1f6ebb286a3ad3367c4964dd Upstream-Status: Inappropriate [Dasharo downstream] Signed-off-by: Filip Lewiński <filip.lewinski@3mdeb.com>
1. Don't try to power it on again if it was powered on already. 2. Kick the platform via global reset if the GPU fails to come up. This reliably fixes dGPU detection. Upstream-Status: Pending Change-Id: I76b80ec8c988d25adff23f02b697d98885848f35 Signed-off-by: Michał Kopeć <michal.kopec@3mdeb.com>
Upstream-Status: Inappropriate [Dasharo downstream] Change-Id: I74f38ddfec9a3665478875e4866731fef5587379 Signed-off-by: Filip Lewiński <filip.lewinski@3mdeb.com>
Change-Id: Ied54e079fe913e724e5da822d1051dc340b29884 Upstream-Status: Inappropriate [Dasharo downstream] Signed-off-by: Jakub Redmerski <jakub.redmerski@3mdeb.com>
Upstream-Status: Inappropriate [Dasharo downstream] Change-Id: I795041b444888fe6524640fdf3d042e8ed9fa6cd Signed-off-by: Jakub Redmerski <jakub.redmerski@3mdeb.com>
Upstream-Status: Inappropriate [Dasharo downstream] Change-Id: I0cd8d6d472e61f5b0911c3411ba7f521fe81f520 Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>
Change-Id: I456109d3836c1982206aa2c4397c8b85b06c68cf Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>
Signed-off-by: Michał Żygowski <michal.zygowski@3mdeb.com>
Upstream-Status: Inappropriate [Dasharo downstream] Signed-off-by: Michał Żygowski <michal.zygowski@3mdeb.com>
Signed-off-by: Filip Lewiński <filip.lewinski@3mdeb.com> Signed-off-by: Michał Kopeć <michal.kopec@3mdeb.com>
Signed-off-by: Michał Kopeć <michal.kopec@3mdeb.com>
Upstream-Status: Inappropriate (not all boards upstreamed) Change-Id: Ie7a55f50826f4daa45260a327bc76437e236b297 Signed-off-by: Michał Kopeć <michal.kopec@3mdeb.com>
Change-Id: I43543123ab09b9a3309c44f081d6a5901da15248 Signed-off-by: Michał Kopeć <michal.kopec@3mdeb.com>
Change-Id: Id947352ae6105962006898e6568f76b64fe2a066 Signed-off-by: Michał Kopeć <michal.kopec@3mdeb.com>
Upstream-Status: Pending Change-Id: Ica3976097f87ef76bf795a5ce73f68bbf2f51c16 Signed-off-by: Michał Kopeć <michal.kopec@3mdeb.com>
Signed-off-by: Michał Żygowski <michal.zygowski@3mdeb.com>
This reverts commit 63b3ec7.
Upstream-Status: Inappropriate (Dasharo downstream) Change-Id: If6c8373d09d19bc6c6481719061d4f28c8c82eac Signed-off-by: Michał Kopeć <michal.kopec@3mdeb.com>
Signed-off-by: Filip Lewiński <filip.lewinski@3mdeb.com>
…port Signed-off-by: Filip Lewiński <filip.lewinski@3mdeb.com>
Signed-off-by: Filip Lewiński <filip.lewinski@3mdeb.com>
Signed-off-by: Filip Lewiński <filip.lewinski@3mdeb.com>
Signed-off-by: Filip Lewiński <filip.lewinski@3mdeb.com>
UEFIExtract gets downloaded when building for laptops with ./build.sh as of recent. Adding it to .gitignore for convenience. Signed-off-by: Filip Lewiński <filip.lewinski@3mdeb.com>
Accounts for the itroduction of the CONFIG_EDK2_FTDI_USB_UART_SUPPORT=y Kconfig option Signed-off-by: Filip Lewiński <filip.lewinski@3mdeb.com>
Upstream-Status: Inappropriate (Dasharo downstream) Change-Id: Ia9675d4a9e4259b1e88180931a03f6d314afaf68 Signed-off-by: Michał Kopeć <michal.kopec@3mdeb.com> Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>
Upstream-Status: Inappropriate (Dasharo downstream) Change-Id: I5dcf598ff91bdc3326bb0f7ebd73948db55c91a1 Signed-off-by: Michał Kopeć <michal.kopec@3mdeb.com>
Upstream-Status: Inappropriate (Dasharo downstream) Change-Id: I8c3a5a5e2bb659e5caf120ef784e887a7ae8a6ef Signed-off-by: Michał Kopeć <michal.kopec@3mdeb.com>
Upstream-Status: Inappropriate (Dasharo downstream) Change-Id: I55dc4c6bc4682f2a140f2d34940eee4a2e5aa46f Signed-off-by: Michał Kopeć <michal.kopec@3mdeb.com>
When CPU doesn't support SMX, a DRTM is not possible, yet any reboot seems to be treated as DRTM reset. Discard TXT error and secret bits as irrelevant to avoid unnecessarily clearing DRAM on reboots as that makes reboot significantly longer. This applies to platforms which have CONFIG_INTEL_TXT for CBnT, have a TXT-enabled chipset, but don't have a CPU with TXT support. Change-Id: If937419d4186c7421c3eb52daf0cc299993b5068 Upstream-Status: Pending Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>
Change-Id: I96458f500fd6967c719b4e0e08029e28240f25f5 Signed-off-by: Michał Kopeć <michal.kopec@3mdeb.com>
Upstream-Status: Inappropriate [Dasharo downstream] Change-Id: Ie1dc7406b5f1b5a6b6e96aad5e3d7810caadccf1 Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>
That is the function which all code related to measurements ends up calling. For this reason it must be responsible for initializing the log. Without this change, vboot_extend_pcr() may invoke tpm_extend_pcr() before the log is being initialized indirectly by a call to tspi_cbfs_measurement() resulting in a failure to log VBOOT measurements. Change-Id: I98fdb4cdab72ae23ad895898eac11dd6c864a20e Upstream-Status: Pending Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>
Change-Id: Ifb71b4ee4736c1808505cf8a985d73f311552b87 Upstream-Status: Inappropriate [Dasharo downstream] Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>
Upstream-Status: Inappropriate [Dasharo downstream] Change-Id: I4a732b79b1a24e2bd9a0db8c0957ea02e7fc46e5 Signed-off-by: Maciej Pijanowski <maciej.pijanowski@3mdeb.com>
The option is not implemented on this platform yet, and it's unknown whether such implementation is even possible. Upstream-Status: Inappropriate [Dasharo downstream] Signed-off-by: Filip Lewiński <filip.lewinski@3mdeb.com>
…r IO as well The Super IO also has its own registers determining the power failure resume behavior. They need to be set accordingly to the option as well, besides the SoC-wide PMC write. Upstream-Status: Inappropriate [Dasharo downstream] Signed-off-by: Filip Lewiński <filip.lewinski@3mdeb.com>
Upstream-Status: Inappropriate [Dasharo downstream] Signed-off-by: Filip Gołaś <filip.golas@3mdeb.com>
The Image Processing Unit is only required for CSI/MIPI cameras, which is not present on the platform. Upstream-Status: Pending Signed-off-by: Filip Lewiński <filip.lewinski@3mdeb.com>
IntelGopDriver has been removed from the NUC BOX blobs, since it's no longer needed. Upstream-Status: Inappropriate [Dasharo downstream] Signed-off-by: Filip Lewiński <filip.lewinski@3mdeb.com>
Upstream-Status: Inappropriate [Dasharo downstream] Signed-off-by: Filip Lewiński <filip.lewinski@3mdeb.com>
Disable serial redir. by default Upstream-Status: Inappropriate [Dasharo downstream] Signed-off-by: Filip Lewiński <filip.lewinski@3mdeb.com>
Change-Id: Ia7789ca2e7ae96880d439665492bdb9f367dd6bd Upstream-Status: Pending Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>
When set, the value of ACM_POLICY_STATUS register is masked to exclude dynamically detectable values making measurements more reliable. Upstream-Status: Pending Change-Id: I25ae3794c7aa0cf7bae66a498098bc74f1bbebf2 Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>
Saw it being mentioned in CBnT BWG, adding it here to have easier time when we get to trying BtG with TPM 1.2. Upstream-Status: Pending Change-Id: I25b4fdf8dad40a4f1c17e302156f8eaab25a9560 Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>
This is a preparation for supporting measurements on MTL and newer generations. Change-Id: I7f49d6defb0ba71868eb8aa971dfbc3b8941f3c7 Upstream-Status: Pending Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>
Differences from the previous way of measurements:
- must log CRTM version to PCR-0
- must log IBB hash (as is, provided in BPM)to PCR-0
- need to extend PCR-0 with POLICY_DATA which is a subset of PCR0_DATA
from the original ("conventional") way
Half of the changes is just moving things into if-statement.
Upstream-Status: Pending
Change-Id: Icc101aa03db99a741c3b7142aa00d42ec6569ae9
Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>
philipanda
force-pushed
the
build.sh-fix-for-selinux
branch
from
August 22, 2025 08:02
899fe86 to
7106e31
Compare
When the repository is cloned to a directory with a domain that is not accessible by containers by default (like user_home_t), the build might fail due to access denials, or just fail silently.
`ausearch -m avc -ts recent -i` shows violation logs like:
```
type=AVC msg=audit(08/22/2025 09:43:42.740:641) : avc: denied { write } for pid=18611 comm=rm name=coreboot dev="dm-0" ino=85471 scontext=system_u:system_r:container_t:s0:c100,c319 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir permissive=1
```
- `container_t` cannot access `user_home_t`, so the access is denied.
Adding `:Z` suffix to the volumes relabels them with a domain that is accessible to `container_t` in SELinux. Specifically `:Z` says that the volumes will be only accessible by this one single container, and not shared between multiple ones. This way the build.sh script can be used without issues on SELinux-enabled systems without changing SELinux enforcement mode.
Source: https://docs.docker.com/engine/storage/bind-mounts/#configure-the-selinux-label
Upstream-Status: Inappropriate [Dasharo downstream]
Signed-off-by: Filip Gołaś <filip.golas@3mdeb.com>
philipanda
force-pushed
the
build.sh-fix-for-selinux
branch
from
August 22, 2025 08:10
7106e31 to
ffe4dfe
Compare
Contributor
Author
|
@pietrushnic does your system use SELinux? I wonder how this affects systems without it |
Contributor
I don't think so, I didn't enable it on my Debian 12. |
philipanda
dismissed
pietrushnic’s stale review
August 18, 2026 14:45
The merge-base changed after approval.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
11 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
When the repository is cloned to a directory with a domain that is not accessible by containers by default (like user_home_t), the build might fail due to access denials, or just fail silently.
ausearch -m avc -ts recent -ishows violation logs like:container_tcannot accessuser_home_t, so the access is denied.Adding
:Zsuffix to the volumes relabels them with a domain that is accessible tocontainer_tin SELinux. Specifically:Zsays that the volumes will be only accessible by this one single container, and not shared between multiple ones. This way the build.sh script can be used without issues on SELinux-enabled systems without changing SELinux enforcement mode.Source: https://docs.docker.com/engine/storage/bind-mounts/#configure-the-selinux-label