Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Switch all config options that can be toggled to "=n" when not active from board configs

Open
  • Is something wrong?
#2,202 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
52/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Active
Tech stack
shell
Domain
security

Research direction

Start with config-gui.sh and cbfs-init.sh, then inspect the board configuration files packed into board.cpio for options that are commented out when inactive. Identify every toggleable option that needs an explicit =n value and verify that disabling it produces no effective config.user change or tampering report after reboot.

Written by the indexing model from the issue text.

Description

config-gui.sh is growing in features.

Current board configs either comment board options when deactivated or set them to option=n

The later is better, concrete example:

  • DEBUG is commented in board config, which is packed into CBFS through board.cpio. Since this is commented, the debug=x doesn't exist (not considered)
  • User toggles debugging into config gui. This sets debug=y into config.user overlay, which is applied on boot by cbfs-init.sh and considered when flashed to rom and rebooted.
  • Heads picks the change as tampering. User can reseal or not secrets, produce debug.log and upload for bug report.
  • User deactivated debug, expects logic to save as override which if the same as board config, produce no change and save, flash back to cbfs, reboot
  • since board config never had debug=n, but now config.user has debug=n, Heads measures config.user and sees a change, reports it as tampering.
  • User has to reseal secrets since debug=n was never set at the first place.

Tldr: if we want users to be able to test settings without resealing and rollback, options that are deactivated needs to be set to =n in board config so that when toggled back, Heads doesn't see a change because there are none.

Dominant language
Makefile
Stars
1.6k
Forks
211
Avg merge
3d 14h
Merged PRs (30d)
6

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from linuxboot/heads

All issues in linuxboot/heads

Similar issues

More Security issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.