[coreboot-gerrit] [S] Change in coreboot[master]: security/lockdown: Allow enabling BOOTMEDIA_SMM_BWP from option

[Benjamin Doron (Code Review)]

Attention is currently required from: Sean Rhodes, Jonathan Zhang, Johnny Lin, Christian Walter, Angel Pons, Arthur Heymans, Tim Chu.

Benjamin Doron has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/74828 )

Change subject: security/lockdown: Allow enabling BOOTMEDIA_SMM_BWP from option
......................................................................

Patch Set 2: Code-Review-1

(1 comment)

Patchset:

PS2: 
I like the idea, but this can only be as secure as the option backend. Suppose ring-0 is not a boundary/an attacker has root access. Then, for the CMOS and SMMSTORE option backends, the privilege escalation path is using root's IO privileges to write to RTC or determine the variable's offset in SMMSTORE and trigger an SMI to write it.

For native UEFI variables, it depends on both whether variables have runtime-access and are locked.

Thoughts on adding a Kconfig option? Something like:
`if ((CONFIG(SPI_FLASH_SMM_OPTION) && get_uint_option("bootmedia_smm_bwp", CONFIG(BOOTMEDIA_SMM_BWP)) || CONFIG(BOOTMEDIA_SMM_BWP)) { ... }`