public inbox for devel@edk2.groups.io
 help / color / mirror / Atom feed
From: "Laszlo Ersek" <lersek@redhat.com>
To: devel@edk2.groups.io, michael.kubacki@outlook.com
Cc: Jiewen Yao <jiewen.yao@intel.com>,
	Chao Zhang <chao.b.zhang@intel.com>,
	Jian J Wang <jian.j.wang@intel.com>,
	Hao A Wu <hao.a.wu@intel.com>, Liming Gao <liming.gao@intel.com>,
	Jordan Justen <jordan.l.justen@intel.com>,
	Ard Biesheuvel <ard.biesheuvel@arm.com>,
	Andrew Fish <afish@apple.com>, Ray Ni <ray.ni@intel.com>,
	Anthony Perard <anthony.perard@citrix.com>,
	Julien Grall <julien@xen.org>, Maurice Ma <maurice.ma@intel.com>,
	Guo Dong <guo.dong@intel.com>,
	Benjamin You <benjamin.you@intel.com>
Subject: Re: [edk2-devel] [PATCH v2 00/12] Add the VariablePolicy feature
Date: Tue, 12 May 2020 13:52:52 +0200	[thread overview]
Message-ID: <11a89bca-ea96-9ba0-2177-e995b98e6943@redhat.com> (raw)
In-Reply-To: <MWHPR07MB3440F5CB92F0D7DCF94AA14FE9BE0@MWHPR07MB3440.namprd07.prod.outlook.com>

On 05/12/20 08:46, Michael Kubacki wrote:
> From: Michael Kubacki <michael.kubacki@microsoft.com>
> 
> REF:https://bugzilla.tianocore.org/show_bug.cgi?id=2522
> 
> The 12 patches in this series add the VariablePolicy feature to the core,
> deprecate Edk2VarLock (while adding a compatibility layer to reduce code
> churn), and integrate the VariablePolicy libraries and protocols into
> Variable Services.
> 
> Since the integration requires multiple changes, including adding libraries,
> a protocol, an SMI communication handler, and VariableServices integration,
> the patches are broken up by individual library additions and then a final
> integration. Security-sensitive changes like bypassing Authenticated
> Variable enforcement are also broken out into individual patches so that
> attention can be called directly to them.
> 
> Platform porting instructions are described in this wiki entry:
> https://github.com/tianocore/tianocore.github.io/wiki/VariablePolicy-Protocol---Enhanced-Method-for-Managing-Variables#platform-porting

(1) This wiki article is helpful, thanks.

I have one remark: there's a heading saying "VarCheckPolicyLib NULL
Instance":

https://github.com/tianocore/tianocore.github.io/wiki/VariablePolicy-Protocol---Enhanced-Method-for-Managing-Variables#varcheckpolicylib-null-instance

I think what's meant is "NULL class", not "NULL instance".

(2) The following platform DSC files in edk2 include the non-SMM
variable driver
("MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf"),
but they are not modified by this patch series:

ArmVirtPkg/ArmVirtQemu.dsc
ArmVirtPkg/ArmVirtQemuKernel.dsc
ArmVirtPkg/ArmVirtXen.dsc
OvmfPkg/OvmfXen.dsc
UefiPayloadPkg/UefiPayloadPkgIa32.dsc
UefiPayloadPkg/UefiPayloadPkgIa32X64.dsc

I'm asking that you please (a) include a patch for ArmVirtPkg, (b)
update the OvmfPkg patch to cover "OvmfXen.dsc" too.

Not sure about the UefiPayloadPkg platforms; please ask their maintainers.

(I've CC'd the OvmfXen and UefiPayloadPkg maintainers/reviewers.)

Thanks,
Laszlo

> 
> Discussion of the feature can be found in multiple places throughout
> the last year on the RFC channel, staging branches, and in devel.
> 
> Most recently, this subject was discussed in this thread:
> https://edk2.groups.io/g/devel/message/53712
> (the code branches shared in that discussion are now out of date, but the
> whitepapers and discussion are relevant).
> 
> Cc: Jiewen Yao <jiewen.yao@intel.com>
> Cc: Chao Zhang <chao.b.zhang@intel.com>
> Cc: Jian J Wang <jian.j.wang@intel.com>
> Cc: Hao A Wu <hao.a.wu@intel.com>
> Cc: Liming Gao <liming.gao@intel.com>
> Cc: Jordan Justen <jordan.l.justen@intel.com>
> Cc: Laszlo Ersek <lersek@redhat.com>
> Cc: Ard Biesheuvel <ard.biesheuvel@arm.com>
> Cc: Andrew Fish <afish@apple.com>
> Cc: Ray Ni <ray.ni@intel.com>
> Signed-off-by: Michael Kubacki <michael.kubacki@microsoft.com>
> 
> Changes since v1:
> * Fixed implementation for RuntimeDxe
> * Add PCD to block DisableVariablePolicy
> * Fix the DumpVariablePolicy pagination in SMM
> 
> Bret Barkelew (12):
>   MdeModulePkg: Define the VariablePolicy protocol interface
>   MdeModulePkg: Define the VariablePolicyLib
>   MdeModulePkg: Define the VariablePolicyHelperLib
>   MdeModulePkg: Define the VarCheckPolicyLib and SMM interface
>   MdeModulePkg: Connect VariablePolicy business logic to
>     VariableServices
>   MdeModulePkg: Allow VariablePolicy state to delete protected variables
>   SecurityPkg: Allow VariablePolicy state to delete authenticated
>     variables
>   MdeModulePkg: Change TCG MOR variables to use VariablePolicy
>   MdeModulePkg: Drop VarLock from RuntimeDxe variable driver
>   MdeModulePkg: Add a shell-based functional test for VariablePolicy
>   OvmfPkg: Add VariablePolicy engine to OvmfPkg platform
>   EmulatorPkg: Add VariablePolicy engine to EmulatorPkg platform
> 
>  MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.c                               |  318 +++
>  MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.c                   |  396 ++++
>  MdeModulePkg/Library/VariablePolicyLib/VariablePolicyExtraInitNull.c                     |   46 +
>  MdeModulePkg/Library/VariablePolicyLib/VariablePolicyExtraInitRuntimeDxe.c               |   85 +
>  MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.c                               |  806 +++++++
>  MdeModulePkg/Library/VariablePolicyLib/VariablePolicyUnitTest/VariablePolicyUnitTest.c   | 2285 ++++++++++++++++++++
>  MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/VariablePolicyFuncTestApp.c        | 1942 +++++++++++++++++
>  MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockDxe.c                               |   52 +-
>  MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockSmm.c                               |   60 +-
>  MdeModulePkg/Universal/Variable/RuntimeDxe/VarCheck.c                                    |   49 +-
>  MdeModulePkg/Universal/Variable/RuntimeDxe/VariableDxe.c                                 |   53 +
>  MdeModulePkg/Universal/Variable/RuntimeDxe/VariableLockRequstToLock.c                    |   71 +
>  MdeModulePkg/Universal/Variable/RuntimeDxe/VariablePolicySmmDxe.c                        |  653 ++++++
>  MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDxe.c                       |   14 +
>  SecurityPkg/Library/AuthVariableLib/AuthService.c                                        |   22 +-
>  EmulatorPkg/EmulatorPkg.dsc                                                              |    6 +
>  MdeModulePkg/Include/Guid/VarCheckPolicyMmi.h                                            |   54 +
>  MdeModulePkg/Include/Library/VariablePolicyHelperLib.h                                   |  164 ++
>  MdeModulePkg/Include/Library/VariablePolicyLib.h                                         |  207 ++
>  MdeModulePkg/Include/Protocol/VariablePolicy.h                                           |  157 ++
>  MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.inf                             |   44 +
>  MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.uni                             |   12 +
>  MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.inf                 |   36 +
>  MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.uni                 |   12 +
>  MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.inf                             |   44 +
>  MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.uni                             |   12 +
>  MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLibRuntimeDxe.inf                   |   52 +
>  MdeModulePkg/Library/VariablePolicyLib/VariablePolicyUnitTest/VariablePolicyUnitTest.inf |   41 +
>  MdeModulePkg/MdeModulePkg.ci.yaml                                                        |    4 +-
>  MdeModulePkg/MdeModulePkg.dec                                                            |   26 +-
>  MdeModulePkg/MdeModulePkg.dsc                                                            |   15 +
>  MdeModulePkg/Test/MdeModulePkgHostTest.dsc                                               |   11 +
>  MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/Readme.md                          |   55 +
>  MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/VariablePolicyFuncTestApp.inf      |   42 +
>  MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf                        |    5 +
>  MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmm.inf                               |    4 +
>  MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDxe.inf                     |   12 +
>  MdeModulePkg/Universal/Variable/RuntimeDxe/VariableStandaloneMm.inf                      |    4 +
>  OvmfPkg/OvmfPkgIa32.dsc                                                                  |    8 +
>  OvmfPkg/OvmfPkgIa32X64.dsc                                                               |    8 +
>  OvmfPkg/OvmfPkgX64.dsc                                                                   |    8 +
>  SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf                                  |    2 +
>  42 files changed, 7819 insertions(+), 78 deletions(-)
>  create mode 100644 MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.c
>  create mode 100644 MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.c
>  create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyExtraInitNull.c
>  create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyExtraInitRuntimeDxe.c
>  create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.c
>  create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyUnitTest/VariablePolicyUnitTest.c
>  create mode 100644 MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/VariablePolicyFuncTestApp.c
>  create mode 100644 MdeModulePkg/Universal/Variable/RuntimeDxe/VariableLockRequstToLock.c
>  create mode 100644 MdeModulePkg/Universal/Variable/RuntimeDxe/VariablePolicySmmDxe.c
>  create mode 100644 MdeModulePkg/Include/Guid/VarCheckPolicyMmi.h
>  create mode 100644 MdeModulePkg/Include/Library/VariablePolicyHelperLib.h
>  create mode 100644 MdeModulePkg/Include/Library/VariablePolicyLib.h
>  create mode 100644 MdeModulePkg/Include/Protocol/VariablePolicy.h
>  create mode 100644 MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.inf
>  create mode 100644 MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.uni
>  create mode 100644 MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.inf
>  create mode 100644 MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.uni
>  create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.inf
>  create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.uni
>  create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLibRuntimeDxe.inf
>  create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyUnitTest/VariablePolicyUnitTest.inf
>  create mode 100644 MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/Readme.md
>  create mode 100644 MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/VariablePolicyFuncTestApp.inf
> 


  parent reply	other threads:[~2020-05-12 11:53 UTC|newest]

Thread overview: 10+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-05-12  6:46 [PATCH v2 00/12] Add the VariablePolicy feature Michael Kubacki
2020-05-12  9:30 ` Ard Biesheuvel
2020-05-12 11:52 ` Laszlo Ersek [this message]
2020-05-12 12:15   ` [edk2-devel] " Laszlo Ersek
2020-05-12 12:37     ` Laszlo Ersek
2020-05-12 17:20       ` Michael Kubacki
2020-05-12 13:47   ` Liming Gao
2020-05-13  5:18   ` [EXTERNAL] " Bret Barkelew
2020-05-13 15:18     ` Ma, Maurice
2020-05-13 15:25       ` Bret Barkelew

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-list from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=11a89bca-ea96-9ba0-2177-e995b98e6943@redhat.com \
    --to=devel@edk2.groups.io \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox