Skip to content

Commit ba930bb

Browse files
nickandersonnickanderson
committed
Replaced per-check HSI inventory attributes with pass/fail lists
Changelog: title
1 parent 1d55ad3 commit ba930bb

4 files changed

Lines changed: 200 additions & 195 deletions

File tree

‎inventory/inventory-fwupd/README.org‎

Lines changed: 13 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -46,30 +46,31 @@ For every device fwupd reports (keyed by DeviceId):
4646
| Attribute | Format |
4747
|---------------------------------+------------------------------------------------------------|
4848
| *Firmware HSI level* | =HSI:0= through =HSI:4= |
49-
| *Firmware HSI L<n>: <Name>* | =PASS= or =FAIL= (one per security check) |
50-
| *Firmware HSI attributes* | =Name (HSI L<level>): <result> [PASS|FAIL]= (slist) |
49+
| *Firmware HSI failing* | =L<n>: <Name>= (slist) |
50+
| *Firmware HSI passing* | =L<n>: <Name>= (slist) |
5151

5252
*Firmware HSI level* is the rolled-up Host Security Identifier level.
5353
fwupd walks levels 1--4 sequentially; the result is the highest level
5454
where all attributes pass, stopping at the first level with any failure.
5555

56-
*Firmware HSI L<n>: <Name>* variables (e.g. =Firmware HSI L1: TPM v2.0=)
57-
are individual string attributes with value =PASS= or =FAIL=. These are
58-
consumed by *compliance-report-fwupd* for per-check compliance conditions.
59-
Two normalizations are applied to keep inventory attribute names stable
60-
and aligned with the HSI specification:
56+
*Firmware HSI failing* and *Firmware HSI passing* are slists of the
57+
security checks fwupd reported, split by outcome (e.g. =L1: TPM v2.0=).
58+
The check set is hardware dependent, so a check in neither list is not
59+
applicable to this host. *compliance-report-fwupd* matches an exact item
60+
against *Firmware HSI failing* for its per-check conditions.
61+
62+
Items keep the =L<n>:= prefix because the name alone is not unique:
63+
fwupd reports two distinct checks named =Platform debugging=, at L1
64+
(Intel DCI) and L2 (debug locked). Two normalizations keep items stable:
6165

6266
- *Name normalization:* The CSME version attribute is emitted as
63-
=Firmware HSI L1: CSME version= regardless of the firmware version
64-
string fwupd reports (which varies per host).
67+
=L1: CSME version= regardless of the firmware version string fwupd
68+
reports (which varies per host).
6569
- *Level normalization:* fwupd marks some runtime checks at HsiLevel 0
6670
even though they contribute to scored HSI levels. The module maps
6771
these to their specification levels: =UEFI secure boot= is emitted
6872
at L1 (not L0) and =CET OS Support= at L3 (not L0).
6973

70-
*Firmware HSI attributes* is an slist with one detailed entry per
71-
security check, useful for drill-down in Mission Portal inventory views.
72-
7374
* Measurements
7475

7576
The following values are emitted as =cf-monitord= measurements for

‎inventory/inventory-fwupd/policy.cf‎

Lines changed: 24 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -383,10 +383,8 @@ bundle agent inventory_fwupd_hsi(security_src)
383383
# compute the rolled-up HSI level.
384384
#
385385
# Emits:
386-
# - Per-attribute PASS/FAIL strings named "Firmware HSI L<n>: <Name>"
387-
# for use in compliance report conditions.
388-
# - An slist of detailed results formatted "Name (HSI L<level>):
389-
# <result> [PASS|FAIL]" for inventory drill-down.
386+
# - "Firmware HSI failing" and "Firmware HSI passing", slists of
387+
# "L<level>: <name>" check names split by outcome.
390388
# - A count of failing attributes.
391389
# - The rolled-up HSI level (e.g. "HSI:3").
392390
#
@@ -444,10 +442,9 @@ bundle agent inventory_fwupd_hsi(security_src)
444442
"$(_name[$(_idxes)])"
445443
);
446444

447-
# Normalized level for per-attribute inventory: fwupd marks some
448-
# attributes as HsiLevel 0 with a "runtime-issue" flag even though
449-
# they contribute to scored HSI levels. Map them to their HSI spec
450-
# level so inventory attribute names match compliance conditions.
445+
# Normalized level: fwupd marks some attributes as HsiLevel 0 with a
446+
# "runtime-issue" flag even though they contribute to scored HSI
447+
# levels. Map them to their HSI spec level so list items are stable.
451448
# UEFI secure boot (org.fwupd.hsi.Uefi.SecureBoot) → HSI:1
452449
# CET OS Support (org.fwupd.hsi.IntelCet.Active) → HSI:3
453450
"_inv_level[$(_idxes)]"
@@ -459,19 +456,25 @@ bundle agent inventory_fwupd_hsi(security_src)
459456
"$(_level[$(_idxes)])"
460457
);
461458

462-
# Per-attribute inventory: one string variable per HSI check,
463-
# named "Firmware HSI L<level>: <name>" with value PASS or FAIL.
464-
# This enables per-check compliance report conditions.
465-
"fwupd_hsi_check[$(_idxes)]"
466-
string => "$(_status[$(_idxes)])",
467-
meta => {
468-
"inventory",
469-
"attribute_name=Firmware HSI L$(_inv_level[$(_idxes)]): $(_inv_name[$(_idxes)])",
470-
};
471-
472-
"fwupd_hsi_attr[$(_idxes)]"
473-
string => "$(_name[$(_idxes)]) (HSI L$(_level[$(_idxes)])): $(_result[$(_idxes)]) [$(_status[$(_idxes)])]",
474-
meta => { "inventory", "attribute_name=Firmware HSI attributes" };
459+
# Check names split by outcome, rather than one attribute per check,
460+
# which accumulated the fleet-wide union of a hardware-dependent set.
461+
# A check in neither list is not applicable to this host. The level
462+
# prefix disambiguates fwupd's two "Platform debugging" checks.
463+
"_failing_name[$(_idxes)]"
464+
string => "L$(_inv_level[$(_idxes)]): $(_inv_name[$(_idxes)])",
465+
if => strcmp("$(_status[$(_idxes)])", "FAIL");
466+
467+
"_passing_name[$(_idxes)]"
468+
string => "L$(_inv_level[$(_idxes)]): $(_inv_name[$(_idxes)])",
469+
if => strcmp("$(_status[$(_idxes)])", "PASS");
470+
471+
"fwupd_hsi_failing"
472+
slist => getvalues("_failing_name"),
473+
meta => { "inventory", "attribute_name=Firmware HSI failing" };
474+
475+
"fwupd_hsi_passing"
476+
slist => getvalues("_passing_name"),
477+
meta => { "inventory", "attribute_name=Firmware HSI passing" };
475478

476479
"fwupd_hsi_failing_count"
477480
int => countclassesmatching("inventory_fwupd_hsi_failing_[0-9]+");

‎reporting/compliance-report-fwupd/README.org‎

Lines changed: 79 additions & 78 deletions
Original file line numberDiff line numberDiff line change
@@ -22,116 +22,117 @@ checks covering every individual HSI firmware security test.
2222

2323
* Rolled-up Conditions
2424

25-
| Condition | Category | Severity |
26-
|-----------------------------------+--------------------+----------|
27-
| *fwupd installed* | Firmware tooling | high |
28-
| *HSI Level 1+ (Critical)* | HSI Level Overview | high |
29-
| *HSI Level 2+ (Important)* | HSI Level Overview | medium |
30-
| *HSI Level 3+ (Recommended)* | HSI Level Overview | low |
31-
| *HSI Level 4 (Complete)* | HSI Level Overview | low |
32-
| *No pending firmware updates* | Firmware updates | medium |
33-
| *Firmware status healthy* | Firmware updates | medium |
25+
| Condition | Category | Severity |
26+
|-------------------------------+--------------------+----------|
27+
| *fwupd installed* | Firmware tooling | high |
28+
| *HSI Level 1+ (Critical)* | HSI Level Overview | high |
29+
| *HSI Level 2+ (Important)* | HSI Level Overview | medium |
30+
| *HSI Level 3+ (Recommended)* | HSI Level Overview | low |
31+
| *HSI Level 4 (Complete)* | HSI Level Overview | low |
32+
| *No pending firmware updates* | Firmware updates | medium |
33+
| *Firmware status healthy* | Firmware updates | medium |
3434

3535
HSI level checks are cumulative thresholds -- a host at HSI:3 passes
3636
the Level 1+, 2+, and 3+ conditions but fails Level 4.
3737

3838
* Per-Attribute Conditions
3939

4040
Each individual HSI firmware security check is a separate compliance
41-
condition. The inventory attribute name follows the pattern
42-
=Firmware HSI L<level>: <Name>= with value =PASS= or =FAIL=.
41+
condition. Every one matches an exact item against the
42+
*Firmware HSI failing* slist from *inventory-fwupd*, whose items follow
43+
the pattern =L<level>: <Name>=.
4344

4445
Per-attribute conditions use ~condition_for: "failing"~ -- a host is
45-
only marked failing when the attribute is explicitly =FAIL=. Hosts
46-
that don't report a given attribute (e.g., Intel-only checks on AMD
47-
hardware, or VMs without HSI data) show as "not evaluated" rather
48-
than failing. The checks are defined by the
46+
only marked failing when the check appears in that list. Hosts that
47+
don't report a given check (e.g., Intel-only checks on AMD hardware, or
48+
VMs without HSI data) show as "not evaluated" rather than failing,
49+
because the check appears in neither the failing nor the passing list. The checks are defined by the
4950
[[https://fwupd.github.io/libfwupdplugin/hsi.html][fwupd HSI specification]].
5051

5152
** Level 1 -- Critical (19 conditions, severity: high)
5253

53-
| Condition | Inventory attribute | Platform |
54-
|------------------------------+--------------------------------------------+----------|
55-
| UEFI SecureBoot | =Firmware HSI L1: UEFI secure boot= | All |
56-
| TPM 2.0 Present | =Firmware HSI L1: TPM v2.0= | All |
57-
| Empty PCR in TPM | =Firmware HSI L1: TPM empty PCRs= | All |
58-
| UEFI Platform Key | =Firmware HSI L1: UEFI platform key= | All |
59-
| BIOS Capsule Updates | =Firmware HSI L1: BIOS firmware updates= | All |
60-
| Supported CPU | =Firmware HSI L1: Supported CPU= | All |
61-
| UEFI BootService Variables | =Firmware HSI L1: UEFI bootservice variables= | All |
62-
| BIOS Write Enable (BWE) | =Firmware HSI L1: SPI write= | Intel |
63-
| BIOS Lock Enable (BLE) | =Firmware HSI L1: SPI lock= | Intel |
64-
| SMM BIOS Write Protect | =Firmware HSI L1: SPI BIOS region= | Intel |
65-
| Read-only SPI Descriptor | =Firmware HSI L1: SPI descriptor= | Intel |
66-
| Platform Debug (Intel DCI) | =Firmware HSI L1: Platform debugging= | Intel |
67-
| ME Manufacturing Mode | =Firmware HSI L1: csme manufacturing mode= | Intel |
68-
| ME Flash Descriptor Override | =Firmware HSI L1: csme override= | Intel |
69-
| ME BootGuard Platform Key | =Firmware HSI L1: MEI key manifest= | Intel |
70-
| CSME Version | =Firmware HSI L1: CSME version= | Intel |
71-
| Part is Fused | =Firmware HSI L1: Part is fused= | Intel |
72-
| AMD Microcode Signature | =Firmware HSI L1: AMD microcode signature= | AMD |
73-
| SMM Locked Down | =Firmware HSI L1: SMM locked down= | AMD |
54+
| Condition | List item | Platform |
55+
|------------------------------+----------------------------------+----------|
56+
| UEFI SecureBoot | =L1: UEFI secure boot= | All |
57+
| TPM 2.0 Present | =L1: TPM v2.0= | All |
58+
| Empty PCR in TPM | =L1: TPM empty PCRs= | All |
59+
| UEFI Platform Key | =L1: UEFI platform key= | All |
60+
| BIOS Capsule Updates | =L1: BIOS firmware updates= | All |
61+
| Supported CPU | =L1: Supported CPU= | All |
62+
| UEFI BootService Variables | =L1: UEFI bootservice variables= | All |
63+
| BIOS Write Enable (BWE) | =L1: SPI write= | Intel |
64+
| BIOS Lock Enable (BLE) | =L1: SPI lock= | Intel |
65+
| SMM BIOS Write Protect | =L1: SPI BIOS region= | Intel |
66+
| Read-only SPI Descriptor | =L1: SPI descriptor= | Intel |
67+
| Platform Debug (Intel DCI) | =L1: Platform debugging= | Intel |
68+
| ME Manufacturing Mode | =L1: csme manufacturing mode= | Intel |
69+
| ME Flash Descriptor Override | =L1: csme override= | Intel |
70+
| ME BootGuard Platform Key | =L1: MEI key manifest= | Intel |
71+
| CSME Version | =L1: CSME version= | Intel |
72+
| Part is Fused | =L1: Part is fused= | Intel |
73+
| AMD Microcode Signature | =L1: AMD microcode signature= | AMD |
74+
| SMM Locked Down | =L1: SMM locked down= | AMD |
7475

7576
** Level 2 -- Important (12 conditions, severity: medium)
7677

77-
| Condition | Inventory attribute | Platform |
78-
|----------------------------+-------------------------------------------------+----------|
79-
| DMA Protection (IOMMU) | =Firmware HSI L2: IOMMU= | All |
80-
| PCR0 TPM Event Log | =Firmware HSI L2: TPM PCR0 reconstruction= | All |
81-
| BIOS Rollback Protection | =Firmware HSI L2: BIOS rollback protection= | All |
82-
| Intel BootGuard Enabled | =Firmware HSI L2: Intel BootGuard= | Intel |
83-
| Intel BootGuard Verified | =Firmware HSI L2: Intel BootGuard verified boot= | Intel |
84-
| Intel BootGuard ACM | =Firmware HSI L2: Intel BootGuard ACM protected= | Intel |
85-
| Intel BootGuard OTP | =Firmware HSI L2: Intel BootGuard OTP fuse= | Intel |
86-
| Part is Debug Locked | =Firmware HSI L2: Platform debugging= | Intel |
87-
| Intel GDS Mitigation | =Firmware HSI L2: Intel GDS mitigation= | Intel |
88-
| AMD Platform Secure Boot | =Firmware HSI L2: AMD platform secure boot= | AMD |
89-
| AMD SPI Write Protections | =Firmware HSI L2: AMD SPI write protections= | AMD |
90-
| HP SureStart | =Firmware HSI L2: HP SureStart= | HP |
78+
| Condition | List item | Platform |
79+
|---------------------------+-------------------------------------+----------|
80+
| DMA Protection (IOMMU) | =L2: IOMMU= | All |
81+
| PCR0 TPM Event Log | =L2: TPM PCR0 reconstruction= | All |
82+
| BIOS Rollback Protection | =L2: BIOS rollback protection= | All |
83+
| Intel BootGuard Enabled | =L2: Intel BootGuard= | Intel |
84+
| Intel BootGuard Verified | =L2: Intel BootGuard verified boot= | Intel |
85+
| Intel BootGuard ACM | =L2: Intel BootGuard ACM protected= | Intel |
86+
| Intel BootGuard OTP | =L2: Intel BootGuard OTP fuse= | Intel |
87+
| Part is Debug Locked | =L2: Platform debugging= | Intel |
88+
| Intel GDS Mitigation | =L2: Intel GDS mitigation= | Intel |
89+
| AMD Platform Secure Boot | =L2: AMD platform secure boot= | AMD |
90+
| AMD SPI Write Protections | =L2: AMD SPI write protections= | AMD |
91+
| HP SureStart | =L2: HP SureStart= | HP |
9192

9293
** Level 3 -- Recommended (8 conditions, severity: low)
9394

94-
| Condition | Inventory attribute | Platform |
95-
|------------------------------------+----------------------------------------------+----------|
96-
| Suspend-to-Idle | =Firmware HSI L3: Suspend-to-idle= | All |
97-
| Suspend to RAM Disabled | =Firmware HSI L3: Suspend-to-ram= | All |
98-
| Pre-boot DMA Protection | =Firmware HSI L3: Pre-boot DMA protection= | All |
99-
| CET Available | =Firmware HSI L3: CET Platform= | All |
100-
| CET Utilized by OS | =Firmware HSI L3: CET OS Support= | All |
101-
| Early-boot UEFI Memory Protections | =Firmware HSI L3: UEFI memory protections= | All |
102-
| Intel BootGuard Policy | =Firmware HSI L3: Intel BootGuard error policy= | Intel |
103-
| AMD SPI Replay Protections | =Firmware HSI L3: AMD SPI replay protections= | AMD |
95+
| Condition | List item | Platform |
96+
|------------------------------------+------------------------------------+----------|
97+
| Suspend-to-Idle | =L3: Suspend-to-idle= | All |
98+
| Suspend to RAM Disabled | =L3: Suspend-to-ram= | All |
99+
| Pre-boot DMA Protection | =L3: Pre-boot DMA protection= | All |
100+
| CET Available | =L3: CET Platform= | All |
101+
| CET Utilized by OS | =L3: CET OS Support= | All |
102+
| Early-boot UEFI Memory Protections | =L3: UEFI memory protections= | All |
103+
| Intel BootGuard Policy | =L3: Intel BootGuard error policy= | Intel |
104+
| AMD SPI Replay Protections | =L3: AMD SPI replay protections= | AMD |
104105

105106
** Level 4 -- Complete (3 conditions, severity: low)
106107

107-
| Condition | Inventory attribute | Platform |
108-
|-------------------------------+--------------------------------------------+----------|
109-
| DRAM Memory Encryption | =Firmware HSI L4: Encrypted RAM= | All |
110-
| SMAP | =Firmware HSI L4: SMAP= | All |
111-
| AMD Secure Processor Rollback | =Firmware HSI L4: AMD rollback protection= | AMD |
108+
| Condition | List item | Platform |
109+
|-------------------------------+-------------------------------+----------|
110+
| DRAM Memory Encryption | =L4: Encrypted RAM= | All |
111+
| SMAP | =L4: SMAP= | All |
112+
| AMD Secure Processor Rollback | =L4: AMD rollback protection= | AMD |
112113

113114
* Categories
114115

115116
| Category | Conditions | Scope |
116117
|---------------------------+------------+----------------------------|
117-
| HSI Level Overview | 4 | Rolled-up level thresholds |
118-
| HSI Level 1 - Critical | 19 | Per-attribute checks |
119-
| HSI Level 2 - Important | 12 | Per-attribute checks |
120-
| HSI Level 3 - Recommended | 8 | Per-attribute checks |
121-
| HSI Level 4 - Complete | 3 | Per-attribute checks |
122-
| Firmware updates | 2 | Update status |
123-
| Firmware tooling | 1 | fwupd installation |
118+
| HSI Level Overview | 4 | Rolled-up level thresholds |
119+
| HSI Level 1 - Critical | 19 | Per-attribute checks |
120+
| HSI Level 2 - Important | 12 | Per-attribute checks |
121+
| HSI Level 3 - Recommended | 8 | Per-attribute checks |
122+
| HSI Level 4 - Complete | 3 | Per-attribute checks |
123+
| Firmware updates | 2 | Update status |
124+
| Firmware tooling | 1 | fwupd installation |
124125

125126
* Platform support
126127

127128
Linux only. Platform-specific conditions use =host_filter= class
128129
expressions so they only activate on relevant hardware:
129130

130-
| Platform | =host_filter= | Conditions | Detection |
131-
|----------+----------------------------+------------+--------------------------------|
132-
| All | =linux= | 25 | -- |
133-
| Intel | =fwupd_cpu_vendor_intel= | 17 | =/proc/cpuinfo= vendor_id |
134-
| AMD | =fwupd_cpu_vendor_amd= | 6 | =/proc/cpuinfo= vendor_id |
135-
| HP | =fwupd_oem_vendor_hp= | 1 | =/sys/class/dmi/id/sys_vendor= |
131+
| Platform | =host_filter= | Conditions | Detection |
132+
|----------+--------------------------+------------+--------------------------------|
133+
| All | =linux= | 25 | -- |
134+
| Intel | =fwupd_cpu_vendor_intel= | 17 | =/proc/cpuinfo= vendor_id |
135+
| AMD | =fwupd_cpu_vendor_amd= | 6 | =/proc/cpuinfo= vendor_id |
136+
| HP | =fwupd_oem_vendor_hp= | 1 | =/sys/class/dmi/id/sys_vendor= |
136137

137138
These classes are defined by the *inventory-fwupd* module.

0 commit comments

Comments
 (0)