env: ENV_WRITEABLE_LIST with ".flags" variable

Zixun LI admin at hifiphile.com
Wed Oct 30 16:15:28 CET 2024


Hello,

I read the code about environment variable protection and an old
discussion: https://lists.denx.de/pipermail/u-boot/2021-April/446247.html
but I still have a question.

In env_flags_init() we have:
  if (first_call) {
    #ifdef CONFIG_ENV_WRITEABLE_LIST
      flags_list = ENV_FLAGS_LIST_STATIC;
    #else
      flags_list = env_get(ENV_FLAGS_VAR);
    #endif
    first_call = 0;
  }

When ENV_WRITEABLE_LIST is enabled, why do we have to initialize the list
with ENV_FLAGS_LIST_STATIC instead of ".flags" ? Doing so makes ".flags"
being ignored.

In env_flags_lookup() there is already a fallback when a flag is not
found, the static list will be checked.

Since default env is firstly loaded in env_load(), external ".flags" are
rejected and don't affect the security:
  change_ok() rejected setting variable .flags, skipping it!

Advantage of using .flags is being able to use a <board>.env file to
group all variables together without modifying the included header.

Best regards,
Zixun


More information about the U-Boot mailing list