Functionality vs Security

[Mihm, James]

Exposing the REST D-Bus APIs via a network interface is bad practice and should be disabled by default. Just because it was done that way in the beginning doesn’t mean that it should remain that way.
Applications should be configured to be secure by default. Consumers of the code should have to intentionally select an insecure configuration - it shouldn't be provided by default. 

With phosphor-webui being replaced by webui-vue, there's not much value for us to upstream our changes to phosphor-webui. Regarding the resource issues, we're having to respond to decisions that were out of our control. 

James.

-----Original Message-----
From: Brad Bishop <bradleyb at fuzziesquirrel.com> 
Sent: Wednesday, February 12, 2020 7:05 PM
To: James Feist <james.feist at linux.intel.com>
Cc: OpenBMC Maillist <openbmc at lists.ozlabs.org>; Gunnar Mills <gmills at linux.vnet.ibm.com>; Mihm, James <james.mihm at intel.com>; Joseph Reynolds <jrey at linux.ibm.com>
Subject: Re: Functionality vs Security



> On Feb 12, 2020, at 7:11 PM, James Feist <james.feist at linux.intel.com> wrote:
> 
> On 2/12/20 4:05 PM, Brad Bishop wrote:
>>> On Feb 12, 2020, at 4:16 PM, James Feist <james.feist at linux.intel.com> wrote:
>>> 
>>> In IRC yesterday I proposed the question of whether to change the default of bmcweb to disable REST D-Bus, or to change it in our meta-layers only. I created the patch here: https://gerrit.openbmc-project.xyz/c/openbmc/bmcweb/+/29344 and I am looking for feedback. While REST D-Bus does expose many useful APIs, and phosphor-webui depends heavily on it, it does leak information to any logged in user. This comes to the question, should we prefer functionality by default or security by default? It is a compile switch either way, so each user can still decide which they prefer. I have the opinion that the default should be the safest configuration, and if someone wants to change that, then they can accept the risk and change the build flag.
>>> 
>>> Thoughts?
>>> 
>>> Thanks,
>>> 
>>> James
>> One idea I have is adding a new distro configuration.  Today we have openbmc-phosphor - we could add a DISTRO=openbmc-secure-at-all-costs to meta-phosphor, and the legacy API could be disabled by default there, and remain enabled by default in openbmc-phosphor.
> 
> I would rather see OpenBMC by default secure. I don't want to see CVEs caused by an insecure default configuration in anybody's platform.

Can you talk more about how this doesn’t meet the goals?  The user always has to pick a distro, so there is a conscious choice between the two.  There wouldn’t be any default with a setup like this.

I guess it is possible to have nodistro, which would be the true default.  I wouldn’t have an issue with these setups:

DISTRO= #nodistro -> full paranoia by default
DISTRO=openbmc-phosphor -> full function by default
DISTRO=openbmc-lockdown -> full paranoia by default

or just:
DISTRO= #nodistro -> full paranoia by default
DISTRO=openbmc-phosphor -> full function by default

would either of these meet the goals?