bartoszek/zephyr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

build: kconfig: Add support for warning insecure features

Browse Source 
Add a new promptless Kconfig symbol (INSECURE). This symbols must
be selected by any setting which is used to enable an insecure
feature.

Signed-off-by: Flavio Ceolin <flavio@hubblenetwork.com>
This commit is contained in:
Flavio Ceolin 2025-07-08 09:45:23 -07:00 committed by Daniel DeGrasse
parent e6894ad576
commit 674fd094aa
3 changed files with 24 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
Kconfig.zephyr
View File

@ -1037,6 +1037,12 @@ config WARN_EXPERIMENTAL
Print a warning when the Kconfig tree is parsed if any experimental Print a warning when the Kconfig tree is parsed if any experimental
features are enabled. features are enabled.
config NOT_SECURE
bool
help
Symbol to be selected by a feature to inidicate that feature is
not secure.
config TAINT config TAINT
bool bool
help help

12
scripts/kconfig/kconfig.py
View File

@ -93,6 +93,8 @@ def main():
if kconf.syms.get('WARN_EXPERIMENTAL', kconf.y).tri_value == 2: if kconf.syms.get('WARN_EXPERIMENTAL', kconf.y).tri_value == 2:
check_experimental(kconf) check_experimental(kconf)
check_not_secure(kconf)
# Hack: Force all symbols to be evaluated, to catch warnings generated # Hack: Force all symbols to be evaluated, to catch warnings generated
# during evaluation. Wait till the end to write the actual output files, so # during evaluation. Wait till the end to write the actual output files, so
# that we don't generate any output if there are warnings-turned-errors. # that we don't generate any output if there are warnings-turned-errors.
@ -266,6 +268,16 @@ def check_experimental(kconf):
selector_name = split_expr(selector, AND)[0].name selector_name = split_expr(selector, AND)[0].name
warn(f'Experimental symbol {selector_name} is enabled.') warn(f'Experimental symbol {selector_name} is enabled.')
def check_not_secure(kconf):
not_secure = kconf.syms.get('NOT_SECURE')
dep_expr = kconf.n if not_secure is None else not_secure.rev_dep
if dep_expr is not kconf.n:
selectors = [s for s in split_expr(dep_expr, OR) if expr_value(s) == 2]
for selector in selectors:
selector_name = split_expr(selector, AND)[0].name
warn(f'Not secure symbol {selector_name} is enabled.')
def promptless(sym): def promptless(sym):
# Returns True if 'sym' has no prompt. Since the symbol might be defined in # Returns True if 'sym' has no prompt. Since the symbol might be defined in

6
share/sysbuild/Kconfig
View File

@ -69,6 +69,12 @@ config WARN_DEPRECATED
Print a warning when the Kconfig tree is parsed if any deprecated Print a warning when the Kconfig tree is parsed if any deprecated
features are enabled. features are enabled.
config NOT_SECURE
bool
help
Symbol to be selected by a feature to inidicate that feature is
not secure.
rsource "images/Kconfig" rsource "images/Kconfig"
menu "Build options" menu "Build options"