Security about IOT

Hi,

I have a question about security of IOT, we use "Cyberwatch Vulnerability Manager" is a vulnerability management platform (in attachments we see report for 2 images debian 10 / debian 11).

-> https://cyberwatch.fr/

Is it possible to implement a utility to update the system to address security vulnerabilities?

How update for exemple linux image ?

Actually on device i use debian utility (https://wiki.debian.org/UnattendedUpgrades). I think this can be a starting point.

Thank's for your help.

Yes, the Debian kernel does not work yet because we are still waiting for TI to complete upstreaming of the board support. Even 6.1 from bookworm will not work.

But you can always build a fresher version of the kernel from https://github.com/siemens/meta-iot2050/. Update to latest image first (4.19 is no longer supported for the IOT2050). From there on, you may only build a kernel package from source, deploy and install it on the device afterward (kas-container build kas-iot2050-example.yml --target linux-iot2050 -> deb file in build/tmp/work/iot2050-debian-arm64/linux-iot2050/*/).

Hi Jan-k,

Thank's you for help. It's work very good for image 5.10 xxx.

I have a park with a hundred of IOT with old version (4.19).
It's not possible to do same as 5.1 -> Get git version with 1.1.1 create image and get deb files ?

It will help me a lot.
Thank's.

To create image with git :
https://support.industry.siemens.com/forum/fr/fr/posts/how-to-build-github-example-image/237116/?page=0&pageSize=10#post929450

If you like to continue the 4.19 series, you would have to merge the stable update into the last version released via meta-iot2050. This may be simple but may also become technically challenging if there should be merge conflicts. In additional, we will not get any bug fixes from the out-of-tree bits (TI and Siemens) this way.

Doing the firmware update remotely is technically possible but comes with some risk if something should go wrong during the update. Precondition for that is having a clear picture of the device states and performing test runs with that state (hopefully just one state) in the lab beforehand.