Skip to content

Burkhard Stubert

Running Wayland Clients as Non-Root Users

Many embedded Linux systems use a Wayland compositor like Weston for window management. Qt applications act as Wayland clients. Weston composes the windows of the Qt applications into a single window and displays it on a screen. I still have to find a Yocto layer that does not start Qt applications as root. This violates the cybersecurity principle that every application should only run with the least privileges possible. Let us figure out how to run Qt applications as non-root users and make our system more secure.

Read More »Running Wayland Clients as Non-Root Users

DISTRO_FEATURES:append After DISTRO_FEATURES:remove Has No Effect

Once we have removed an item from a BitBake variable, we cannot re-append it. The evaluation of the following three assignments of the variable BB_VAR yields the same result, no matter in which order the assignments are executed.

# Code under someone else's control
BB_VAR ?= "x z"
BB_VAR:remove = "a y"

# Code under our control
BB_VAR:append = " y"

### Result: BB_VAR = "x z" instead of "x y z"
Read More »DISTRO_FEATURES:append After DISTRO_FEATURES:remove Has No Effect

EU CRA: Start, Length and End of Support Period

When we look closer at the support period, we’ll find more and more interesting questions.

  • Does the support period start, when the end user buys a product or when a product is released, manufactured or sold for the first time?
  • Can manufacturers set the length of the support period as they see fit?
  • Can manufacturers terminate the support period as they see fit?
  • What obligations do manufacturers have to satisfy during the support period? What after the support period?
  • Are there special rules for products released in the transitional period from 11 December 2024 to 10 December 2027?
  • Does the EU CRA apply to products released before 11 December 2024?
Read More »EU CRA: Start, Length and End of Support Period

EU CRA: Essential Requirements Related to Vulnerability Handling

According to Annex I Part II of the EU CRA, manufacturers must actively search for vulnerabilities in their embedded devices, fix them and publicly disclose them to their users and the cybersecurity authorities. Manufacturers must implement a process to release their devices without any know vulnerabilities and to keep their devices free of vulnerabilities during the whole product lifetime by providing security updates in a timely manner.

Read More »EU CRA: Essential Requirements Related to Vulnerability Handling

Extracting Microservices from a Modular Monolith

When developing the operator terminals for their machines, OEMs must reinvent the wheel over and again. Each OEM implements home-grown solutions for standard features like OTA updates, user authentication, factory installation, machine gateways and IoT gateways. None of these features belong to the OEM’s core business. OEMs could save a lot of time and money, if they could buy these features as ready-made solutions from third-party vendors.

Read More »Extracting Microservices from a Modular Monolith
The image shows an NXP iMX8M Plus board with the 14 essential product requirements around it. The locks around the board symbolise how the EU CRA requirements protect products from cyber attacks.

EU CRA: Essential Requirements Related to Product Properties

Every manufacturer must implement the essential requirements in Annex 1 Part 1 of the EU CRA in their products. They must also document how they comply with the essential requirements in a conformity assessment. The wording of the essential requirements is very generic and hard to understand. Germany’s Federal Office of Information Security (BSI) published a Technical Guideline (PDF) that translates the legalese of the EU CRA into concrete and actionable requirements. I will add lots of examples from my work with embedded Linux devices to illustrate the requirements.

Read More »EU CRA: Essential Requirements Related to Product Properties