Hardening the Barebox Bootloader
summary
Adds a disclosure process and security.md plus a security consideration chapter, integrates fuzzing with libFuzzer and ASAN/UBSAN to test file type, JWT, FIT, device-tree and partition parsing (dozens of memory bugs found and fixed), ships upstream fuzz harnesses, enables W^X and stack guard pages by default, doubles HW RNG drivers, introduces config_insecure and a Kconfig-based security policy workflow that makes builds fail when new security choices are unset, plans OSS-Fuzz after fixing memory leaks and expects DM‑verity/device‑mapper support soon.
AI-written summary · about
chapters (10)
- 0:00Barebox introduction
- 3:55Barebox architecture overview
- 7:09Security docs and hardening
- 10:38Security-sensitive components
- 12:03Fuzzing and memory safety
- 16:34Memory protection defenses
- 19:42Control flow integrity
- 21:51Access control enforcement
- 28:21Security policy setup
- 30:13Static analysis and plans
related talks
38mBootloaders Under Fire: Real-World Threats and Practical Defenses
29mThwarting Unknown Bugs: Hardening Features in the Mainline Linux Kernel
31mThe Bootloader: An Underestimated Risk To Embedded Linux Security
55mVerified Boot: From ROM to Userspace
50mHardening the Linux Guest for the Confidential Cloud Computing: Deep Dive and Results
35mUpstream Kernel Hardening: Recent Progress and Challenges
42mwolfBoot: Open Source Secure Boot and Remote Firmware Updates in Safety-critical..
48mHardening IoMT Medical Devices: Defense‑in‑Depth on Yocto‑Based Embedded Linux