* [PATCH 1/2] SecurityPkg: Tcg2Dxe: Measure DBT into PCR[7]
@ 2017-03-03 8:38 Zhang, Chao B
2017-03-03 8:38 ` [PATCH 2/2] MdeModulePkg: Variable: Update DBT PCR[7] measure Zhang, Chao B
2017-03-03 14:09 ` [PATCH 1/2] SecurityPkg: Tcg2Dxe: Measure DBT into PCR[7] Yao, Jiewen
0 siblings, 2 replies; 4+ messages in thread
From: Zhang, Chao B @ 2017-03-03 8:38 UTC (permalink / raw)
To: edk2-devel; +Cc: star.zeng, jiewen.yao, Chao Zhang
Measure DBT into PCR[7] in initial measurement phase if present and
not empty by following TCG PC Client PFP 00.49.
The previous patch according to 00.21 is removed
1404e3a1508473643efba89af34bd133ab082dd5
Cc: Star Zeng <star.zeng@intel.com>
Cc: Yao Jiewen <jiewen.yao@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Chao Zhang <chao.b.zhang@intel.com>
---
SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.c | 19 ++++++++++++++++++-
1 file changed, 18 insertions(+), 1 deletion(-)
diff --git a/SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.c b/SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.c
index 1d2ac9a..53de666 100644
--- a/SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.c
+++ b/SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.c
@@ -115,7 +115,6 @@ VARIABLE_TYPE mVariableType[] = {
{EFI_KEY_EXCHANGE_KEY_NAME, &gEfiGlobalVariableGuid},
{EFI_IMAGE_SECURITY_DATABASE, &gEfiImageSecurityDatabaseGuid},
{EFI_IMAGE_SECURITY_DATABASE1, &gEfiImageSecurityDatabaseGuid},
- {EFI_IMAGE_SECURITY_DATABASE2, &gEfiImageSecurityDatabaseGuid},
};
EFI_HANDLE mImageHandle;
@@ -2137,6 +2136,24 @@ MeasureAllSecureVariables (
}
}
+ //
+ // Measure DBT if present and not empty
+ //
+ Status = GetVariable2 (EFI_IMAGE_SECURITY_DATABASE2, &gEfiImageSecurityDatabaseGuid, &Data, &DataSize);
+ if (!EFI_ERROR(Status)) {
+ Status = MeasureVariable (
+ 7,
+ EV_EFI_VARIABLE_DRIVER_CONFIG,
+ EFI_IMAGE_SECURITY_DATABASE2,
+ &gEfiImageSecurityDatabaseGuid,
+ Data,
+ DataSize
+ );
+ FreePool(Data);
+ } else {
+ DEBUG((DEBUG_INFO, "Skip measuring variable %s since it's deleted\n", EFI_IMAGE_SECURITY_DATABASE2));
+ }
+
return EFI_SUCCESS;
}
--
1.9.5.msysgit.1
^ permalink raw reply related [flat|nested] 4+ messages in thread
* [PATCH 2/2] MdeModulePkg: Variable: Update DBT PCR[7] measure
2017-03-03 8:38 [PATCH 1/2] SecurityPkg: Tcg2Dxe: Measure DBT into PCR[7] Zhang, Chao B
@ 2017-03-03 8:38 ` Zhang, Chao B
2017-03-03 14:11 ` Zeng, Star
2017-03-03 14:09 ` [PATCH 1/2] SecurityPkg: Tcg2Dxe: Measure DBT into PCR[7] Yao, Jiewen
1 sibling, 1 reply; 4+ messages in thread
From: Zhang, Chao B @ 2017-03-03 8:38 UTC (permalink / raw)
To: edk2-devel; +Cc: star.zeng, jiewen.yao, Chao Zhang
Measure DBT into PCR[7] when it is updated between initial measure
if present and not empty. by following TCG PC Client PFP 00.49
Previous patch for PCR[7] DBT part is overrode.
dc9bd6ed281fcba5358f3004632bdbda968be1e5
Cc: Star Zeng <star.zeng@intel.com>
Cc: Yao Jiewen <jiewen.yao@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Chao Zhang <chao.b.zhang@intel.com>
---
MdeModulePkg/Universal/Variable/RuntimeDxe/Measurement.c | 13 +++++++++++--
1 file changed, 11 insertions(+), 2 deletions(-)
diff --git a/MdeModulePkg/Universal/Variable/RuntimeDxe/Measurement.c b/MdeModulePkg/Universal/Variable/RuntimeDxe/Measurement.c
index 0f1cb18..936b5b0 100644
--- a/MdeModulePkg/Universal/Variable/RuntimeDxe/Measurement.c
+++ b/MdeModulePkg/Universal/Variable/RuntimeDxe/Measurement.c
@@ -242,8 +242,17 @@ SecureBootHook (
&VariableDataSize
);
if (EFI_ERROR (Status)) {
- VariableData = NULL;
- VariableDataSize = 0;
+ //
+ // Measure DBT only if present and not empty
+ //
+ if (StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE2) == 0 &&
+ CompareGuid (VendorGuid, &gEfiImageSecurityDatabaseGuid)) {
+ DEBUG((DEBUG_INFO, "Skip measuring variable %s since it's deleted\n", EFI_IMAGE_SECURITY_DATABASE2));
+ return;
+ } else {
+ VariableData = NULL;
+ VariableDataSize = 0;
+ }
}
Status = MeasureVariable (
--
1.9.5.msysgit.1
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH 1/2] SecurityPkg: Tcg2Dxe: Measure DBT into PCR[7]
2017-03-03 8:38 [PATCH 1/2] SecurityPkg: Tcg2Dxe: Measure DBT into PCR[7] Zhang, Chao B
2017-03-03 8:38 ` [PATCH 2/2] MdeModulePkg: Variable: Update DBT PCR[7] measure Zhang, Chao B
@ 2017-03-03 14:09 ` Yao, Jiewen
1 sibling, 0 replies; 4+ messages in thread
From: Yao, Jiewen @ 2017-03-03 14:09 UTC (permalink / raw)
To: Zhang, Chao B, edk2-devel@lists.01.org; +Cc: Zeng, Star
Both patch are reviewed-by: Jiewen.yao@Intel.com
> -----Original Message-----
> From: Zhang, Chao B
> Sent: Friday, March 3, 2017 4:39 PM
> To: edk2-devel@lists.01.org
> Cc: Zeng, Star <star.zeng@intel.com>; Yao, Jiewen <jiewen.yao@intel.com>;
> Zhang, Chao B <chao.b.zhang@intel.com>
> Subject: [PATCH 1/2] SecurityPkg: Tcg2Dxe: Measure DBT into PCR[7]
>
> Measure DBT into PCR[7] in initial measurement phase if present and
> not empty by following TCG PC Client PFP 00.49.
> The previous patch according to 00.21 is removed
> 1404e3a1508473643efba89af34bd133ab082dd5
>
> Cc: Star Zeng <star.zeng@intel.com>
> Cc: Yao Jiewen <jiewen.yao@intel.com>
> Contributed-under: TianoCore Contribution Agreement 1.0
> Signed-off-by: Chao Zhang <chao.b.zhang@intel.com>
> ---
> SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.c | 19 ++++++++++++++++++-
> 1 file changed, 18 insertions(+), 1 deletion(-)
>
> diff --git a/SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.c
> b/SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.c
> index 1d2ac9a..53de666 100644
> --- a/SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.c
> +++ b/SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.c
> @@ -115,7 +115,6 @@ VARIABLE_TYPE mVariableType[] = {
> {EFI_KEY_EXCHANGE_KEY_NAME, &gEfiGlobalVariableGuid},
> {EFI_IMAGE_SECURITY_DATABASE, &gEfiImageSecurityDatabaseGuid},
> {EFI_IMAGE_SECURITY_DATABASE1, &gEfiImageSecurityDatabaseGuid},
> - {EFI_IMAGE_SECURITY_DATABASE2, &gEfiImageSecurityDatabaseGuid},
> };
>
> EFI_HANDLE mImageHandle;
> @@ -2137,6 +2136,24 @@ MeasureAllSecureVariables (
> }
> }
>
> + //
> + // Measure DBT if present and not empty
> + //
> + Status = GetVariable2 (EFI_IMAGE_SECURITY_DATABASE2,
> &gEfiImageSecurityDatabaseGuid, &Data, &DataSize);
> + if (!EFI_ERROR(Status)) {
> + Status = MeasureVariable (
> + 7,
> + EV_EFI_VARIABLE_DRIVER_CONFIG,
> + EFI_IMAGE_SECURITY_DATABASE2,
> + &gEfiImageSecurityDatabaseGuid,
> + Data,
> + DataSize
> + );
> + FreePool(Data);
> + } else {
> + DEBUG((DEBUG_INFO, "Skip measuring variable %s since it's deleted\n",
> EFI_IMAGE_SECURITY_DATABASE2));
> + }
> +
> return EFI_SUCCESS;
> }
>
> --
> 1.9.5.msysgit.1
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH 2/2] MdeModulePkg: Variable: Update DBT PCR[7] measure
2017-03-03 8:38 ` [PATCH 2/2] MdeModulePkg: Variable: Update DBT PCR[7] measure Zhang, Chao B
@ 2017-03-03 14:11 ` Zeng, Star
0 siblings, 0 replies; 4+ messages in thread
From: Zeng, Star @ 2017-03-03 14:11 UTC (permalink / raw)
To: Zhang, Chao B, edk2-devel@lists.01.org; +Cc: Yao, Jiewen, Zeng, Star
Reviewed-by: Star Zeng <star.zeng@intel.com>
-----Original Message-----
From: Zhang, Chao B
Sent: Friday, March 3, 2017 4:39 PM
To: edk2-devel@lists.01.org
Cc: Zeng, Star <star.zeng@intel.com>; Yao, Jiewen <jiewen.yao@intel.com>; Zhang, Chao B <chao.b.zhang@intel.com>
Subject: [PATCH 2/2] MdeModulePkg: Variable: Update DBT PCR[7] measure
Measure DBT into PCR[7] when it is updated between initial measure if present and not empty. by following TCG PC Client PFP 00.49 Previous patch for PCR[7] DBT part is overrode.
dc9bd6ed281fcba5358f3004632bdbda968be1e5
Cc: Star Zeng <star.zeng@intel.com>
Cc: Yao Jiewen <jiewen.yao@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Chao Zhang <chao.b.zhang@intel.com>
---
MdeModulePkg/Universal/Variable/RuntimeDxe/Measurement.c | 13 +++++++++++--
1 file changed, 11 insertions(+), 2 deletions(-)
diff --git a/MdeModulePkg/Universal/Variable/RuntimeDxe/Measurement.c b/MdeModulePkg/Universal/Variable/RuntimeDxe/Measurement.c
index 0f1cb18..936b5b0 100644
--- a/MdeModulePkg/Universal/Variable/RuntimeDxe/Measurement.c
+++ b/MdeModulePkg/Universal/Variable/RuntimeDxe/Measurement.c
@@ -242,8 +242,17 @@ SecureBootHook (
&VariableDataSize
);
if (EFI_ERROR (Status)) {
- VariableData = NULL;
- VariableDataSize = 0;
+ //
+ // Measure DBT only if present and not empty
+ //
+ if (StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE2) == 0 &&
+ CompareGuid (VendorGuid, &gEfiImageSecurityDatabaseGuid)) {
+ DEBUG((DEBUG_INFO, "Skip measuring variable %s since it's deleted\n", EFI_IMAGE_SECURITY_DATABASE2));
+ return;
+ } else {
+ VariableData = NULL;
+ VariableDataSize = 0;
+ }
}
Status = MeasureVariable (
--
1.9.5.msysgit.1
^ permalink raw reply related [flat|nested] 4+ messages in thread
end of thread, other threads:[~2017-03-03 14:11 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2017-03-03 8:38 [PATCH 1/2] SecurityPkg: Tcg2Dxe: Measure DBT into PCR[7] Zhang, Chao B
2017-03-03 8:38 ` [PATCH 2/2] MdeModulePkg: Variable: Update DBT PCR[7] measure Zhang, Chao B
2017-03-03 14:11 ` Zeng, Star
2017-03-03 14:09 ` [PATCH 1/2] SecurityPkg: Tcg2Dxe: Measure DBT into PCR[7] Yao, Jiewen
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox