env: Add support for explicit write access list
This option marks any U-Boot variable which does not have explicit 'w'
writeable flag set as read-only. This way the environment can be locked
down and only variables explicitly configured to be writeable can ever
be changed by either 'env import', 'env set' or loading user environment
from environment storage.
Signed-off-by: Marek Vasut <marex@denx.de>
Reviewed-by: Tom Rini <trini@konsulko.com>
diff --git a/env/Kconfig b/env/Kconfig
index 1cae1ed..5d0a8ec 100644
--- a/env/Kconfig
+++ b/env/Kconfig
@@ -623,6 +623,14 @@
with newly imported data. This may be used in combination with static
flags to e.g. to protect variables which must not be modified.
+config ENV_WRITEABLE_LIST
+ bool "Permit write access only to listed variables"
+ default n
+ help
+ If defined, only environment variables which explicitly set the 'w'
+ writeable flag can be written and modified at runtime. No variables
+ can be otherwise created, written or imported into the environment.
+
config ENV_ACCESS_IGNORE_FORCE
bool "Block forced environment operations"
default n