Skip to content

Commit b8fefc5

Browse files
author
Nick Anderson
committed
Added compliance-report-fwupd for firmware security posture via fwupd HSI
1 parent 294b1ba commit b8fefc5

4 files changed

Lines changed: 1096 additions & 0 deletions

File tree

‎cfbs.json‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,15 @@
3333
"subdirectory": "reporting/client-initiated-reporting",
3434
"steps": ["json def.json def.json"]
3535
},
36+
"compliance-report-fwupd": {
37+
"description": "Compliance report for firmware security posture via fwupd HSI and update status.",
38+
"tags": ["reporting", "compliance", "security", "hardware"],
39+
"subdirectory": "reporting/compliance-report-fwupd",
40+
"dependencies": ["inventory-fwupd"],
41+
"steps": [
42+
"copy fwupd-compliance-report.json .no-distrib/compliance-report-definitions/fwupd-compliance-report.json"
43+
]
44+
},
3645
"command-dispatcher": {
3746
"description": "Command dispatcher for running shell commands on schedule",
3847
"subdirectory": "management/command-dispatcher",
@@ -246,6 +255,17 @@
246255
"bundles inventory_fde:main"
247256
]
248257
},
258+
"inventory-fwupd": {
259+
"description": "Inventory hardware firmware versions, pending firmware updates, and host security attributes via fwupd.",
260+
"tags": ["inventory", "monitoring", "hardware", "security"],
261+
"subdirectory": "inventory/inventory-fwupd",
262+
"steps": [
263+
"copy policy.cf services/cfbs/modules/inventory-fwupd/policy.cf",
264+
"copy fwupd-inventory.mustache services/cfbs/modules/inventory-fwupd/fwupd-inventory.mustache",
265+
"policy_files services/cfbs/modules/inventory-fwupd/policy.cf",
266+
"bundles inventory_fwupd_main"
267+
]
268+
},
249269
"inventory-smartctl": {
250270
"description": "Inventory SMART drive health, temperature, and wear data.",
251271
"tags": ["inventory", "monitoring", "hardware", "storage"],
@@ -278,6 +298,50 @@
278298
"bundles maintainers_in_motd"
279299
]
280300
},
301+
"manage-fwupd": {
302+
"description": "Ensure fwupd is installed and its refresh timer is enabled. Optionally apply firmware updates for devices matching an allow-list.",
303+
"subdirectory": "management/manage-fwupd",
304+
"dependencies": ["inventory-fwupd"],
305+
"steps": [
306+
"copy main.cf services/cfbs/modules/manage-fwupd/main.cf",
307+
"policy_files services/cfbs/modules/manage-fwupd/main.cf",
308+
"bundles manage_fwupd:allowed manage_fwupd:main",
309+
"input ./input.json def.json"
310+
],
311+
"input": [
312+
{
313+
"type": "string",
314+
"variable": "apply_updates",
315+
"namespace": "manage_fwupd",
316+
"bundle": "allowed",
317+
"label": "Apply firmware updates",
318+
"question": "Class expression for when firmware updates should be applied (e.g. 'any', 'linux', '(env_dev|env_qa).Night.(cohort_A|cohort_C)'). Default '!any' means disabled.",
319+
"default": "!any"
320+
},
321+
{
322+
"type": "list",
323+
"variable": "device_name_reglist",
324+
"namespace": "manage_fwupd",
325+
"bundle": "allowed",
326+
"label": "Allowed devices",
327+
"subtype": {
328+
"type": "string",
329+
"label": "Device name pattern",
330+
"question": "Device name (regex) to allow firmware updates for"
331+
},
332+
"while": "Do you want to allow firmware updates for more devices?"
333+
},
334+
{
335+
"type": "string",
336+
"variable": "reboot_after_update",
337+
"namespace": "manage_fwupd",
338+
"bundle": "allowed",
339+
"label": "Reboot after firmware update",
340+
"question": "Class expression for when to reboot after a firmware update is applied (e.g. 'any', 'Night', 'Hr04.Min00_05'). Default '!any' means disabled (no automatic reboot).",
341+
"default": "!any"
342+
}
343+
]
344+
},
281345
"powershell-execution-policy": {
282346
"description": "Inventory and bundle for PowerShell Execution Policy",
283347
"subdirectory": "management/powershell-execution-policy",

‎reporting/compliance-report-fwupd/README.org‎

Lines changed: 137 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,137 @@
1+
Compliance report definition for firmware security posture via fwupd.
2+
3+
Imports a "Firmware Security (fwupd)" report into Mission Portal that
4+
tracks Host Security Identifier (HSI) levels, fwupd installation, and
5+
firmware update status across the fleet.
6+
7+
The report contains 49 conditions: 7 rolled-up checks (HSI level
8+
thresholds, fwupd installation, update status) and 42 per-attribute
9+
checks covering every individual HSI firmware security test.
10+
11+
* Mission Portal
12+
13+
[[file:mp-compliance-report-fwupd.png]]
14+
15+
* Requirements
16+
17+
- *inventory-fwupd* module providing the inventory attributes and
18+
platform classes (=fwupd_cpu_vendor_intel=, =fwupd_cpu_vendor_amd=,
19+
=fwupd_oem_vendor_hp=) that the compliance conditions reference
20+
- *compliance-report-imports* autorun bundle on the hub to import
21+
the JSON definition into Mission Portal
22+
23+
* Rolled-up Conditions
24+
25+
| Condition | Category | Severity |
26+
|-----------------------------------+--------------------+----------|
27+
| *fwupd installed* | Firmware tooling | high |
28+
| *HSI Level 1+ (Critical)* | HSI Level Overview | high |
29+
| *HSI Level 2+ (Important)* | HSI Level Overview | medium |
30+
| *HSI Level 3+ (Recommended)* | HSI Level Overview | low |
31+
| *HSI Level 4 (Complete)* | HSI Level Overview | low |
32+
| *No pending firmware updates* | Firmware updates | medium |
33+
| *Firmware status healthy* | Firmware updates | medium |
34+
35+
HSI level checks are cumulative thresholds -- a host at HSI:3 passes
36+
the Level 1+, 2+, and 3+ conditions but fails Level 4.
37+
38+
* Per-Attribute Conditions
39+
40+
Each individual HSI firmware security check is a separate compliance
41+
condition. The inventory attribute name follows the pattern
42+
=Firmware HSI L<level>: <Name>= with value =PASS= or =FAIL=.
43+
44+
Per-attribute conditions use ~condition_for: "failing"~ -- a host is
45+
only marked failing when the attribute is explicitly =FAIL=. Hosts
46+
that don't report a given attribute (e.g., Intel-only checks on AMD
47+
hardware, or VMs without HSI data) show as "not evaluated" rather
48+
than failing. The checks are defined by the
49+
[[https://fwupd.github.io/libfwupdplugin/hsi.html][fwupd HSI specification]].
50+
51+
** Level 1 -- Critical (19 conditions, severity: high)
52+
53+
| Condition | Inventory attribute | Platform |
54+
|------------------------------+--------------------------------------------+----------|
55+
| UEFI SecureBoot | =Firmware HSI L1: UEFI secure boot= | All |
56+
| TPM 2.0 Present | =Firmware HSI L1: TPM v2.0= | All |
57+
| Empty PCR in TPM | =Firmware HSI L1: TPM empty PCRs= | All |
58+
| UEFI Platform Key | =Firmware HSI L1: UEFI platform key= | All |
59+
| BIOS Capsule Updates | =Firmware HSI L1: BIOS firmware updates= | All |
60+
| Supported CPU | =Firmware HSI L1: Supported CPU= | All |
61+
| UEFI BootService Variables | =Firmware HSI L1: UEFI bootservice variables= | All |
62+
| BIOS Write Enable (BWE) | =Firmware HSI L1: SPI write= | Intel |
63+
| BIOS Lock Enable (BLE) | =Firmware HSI L1: SPI lock= | Intel |
64+
| SMM BIOS Write Protect | =Firmware HSI L1: SPI BIOS region= | Intel |
65+
| Read-only SPI Descriptor | =Firmware HSI L1: SPI descriptor= | Intel |
66+
| Platform Debug (Intel DCI) | =Firmware HSI L1: Platform debugging= | Intel |
67+
| ME Manufacturing Mode | =Firmware HSI L1: csme manufacturing mode= | Intel |
68+
| ME Flash Descriptor Override | =Firmware HSI L1: csme override= | Intel |
69+
| ME BootGuard Platform Key | =Firmware HSI L1: MEI key manifest= | Intel |
70+
| CSME Version | =Firmware HSI L1: CSME version= | Intel |
71+
| Part is Fused | =Firmware HSI L1: Part is fused= | Intel |
72+
| AMD Microcode Signature | =Firmware HSI L1: AMD microcode signature= | AMD |
73+
| SMM Locked Down | =Firmware HSI L1: SMM locked down= | AMD |
74+
75+
** Level 2 -- Important (12 conditions, severity: medium)
76+
77+
| Condition | Inventory attribute | Platform |
78+
|----------------------------+-------------------------------------------------+----------|
79+
| DMA Protection (IOMMU) | =Firmware HSI L2: IOMMU= | All |
80+
| PCR0 TPM Event Log | =Firmware HSI L2: TPM PCR0 reconstruction= | All |
81+
| BIOS Rollback Protection | =Firmware HSI L2: BIOS rollback protection= | All |
82+
| Intel BootGuard Enabled | =Firmware HSI L2: Intel BootGuard= | Intel |
83+
| Intel BootGuard Verified | =Firmware HSI L2: Intel BootGuard verified boot= | Intel |
84+
| Intel BootGuard ACM | =Firmware HSI L2: Intel BootGuard ACM protected= | Intel |
85+
| Intel BootGuard OTP | =Firmware HSI L2: Intel BootGuard OTP fuse= | Intel |
86+
| Part is Debug Locked | =Firmware HSI L2: Platform debugging= | Intel |
87+
| Intel GDS Mitigation | =Firmware HSI L2: Intel GDS mitigation= | Intel |
88+
| AMD Platform Secure Boot | =Firmware HSI L2: AMD platform secure boot= | AMD |
89+
| AMD SPI Write Protections | =Firmware HSI L2: AMD SPI write protections= | AMD |
90+
| HP SureStart | =Firmware HSI L2: HP SureStart= | HP |
91+
92+
** Level 3 -- Recommended (8 conditions, severity: low)
93+
94+
| Condition | Inventory attribute | Platform |
95+
|------------------------------------+----------------------------------------------+----------|
96+
| Suspend-to-Idle | =Firmware HSI L3: Suspend-to-idle= | All |
97+
| Suspend to RAM Disabled | =Firmware HSI L3: Suspend-to-ram= | All |
98+
| Pre-boot DMA Protection | =Firmware HSI L3: Pre-boot DMA protection= | All |
99+
| CET Available | =Firmware HSI L3: CET Platform= | All |
100+
| CET Utilized by OS | =Firmware HSI L3: CET OS Support= | All |
101+
| Early-boot UEFI Memory Protections | =Firmware HSI L3: UEFI memory protections= | All |
102+
| Intel BootGuard Policy | =Firmware HSI L3: Intel BootGuard error policy= | Intel |
103+
| AMD SPI Replay Protections | =Firmware HSI L3: AMD SPI replay protections= | AMD |
104+
105+
** Level 4 -- Complete (3 conditions, severity: low)
106+
107+
| Condition | Inventory attribute | Platform |
108+
|-------------------------------+--------------------------------------------+----------|
109+
| DRAM Memory Encryption | =Firmware HSI L4: Encrypted RAM= | All |
110+
| SMAP | =Firmware HSI L4: SMAP= | All |
111+
| AMD Secure Processor Rollback | =Firmware HSI L4: AMD rollback protection= | AMD |
112+
113+
* Categories
114+
115+
| Category | Conditions | Scope |
116+
|---------------------------+------------+----------------------------|
117+
| HSI Level Overview | 4 | Rolled-up level thresholds |
118+
| HSI Level 1 - Critical | 19 | Per-attribute checks |
119+
| HSI Level 2 - Important | 12 | Per-attribute checks |
120+
| HSI Level 3 - Recommended | 8 | Per-attribute checks |
121+
| HSI Level 4 - Complete | 3 | Per-attribute checks |
122+
| Firmware updates | 2 | Update status |
123+
| Firmware tooling | 1 | fwupd installation |
124+
125+
* Platform support
126+
127+
Linux only. Platform-specific conditions use =host_filter= class
128+
expressions so they only activate on relevant hardware:
129+
130+
| Platform | =host_filter= | Conditions | Detection |
131+
|----------+----------------------------+------------+--------------------------------|
132+
| All | =linux= | 25 | -- |
133+
| Intel | =fwupd_cpu_vendor_intel= | 17 | =/proc/cpuinfo= vendor_id |
134+
| AMD | =fwupd_cpu_vendor_amd= | 6 | =/proc/cpuinfo= vendor_id |
135+
| HP | =fwupd_oem_vendor_hp= | 1 | =/sys/class/dmi/id/sys_vendor= |
136+
137+
These classes are defined by the *inventory-fwupd* module.

0 commit comments

Comments
 (0)