From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from us-smtp-1.mimecast.com (us-smtp-1.mimecast.com [205.139.110.120]) by mx.groups.io with SMTP id smtpd.web11.4123.1589284384198975489 for ; Tue, 12 May 2020 04:53:05 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@redhat.com header.s=mimecast20190719 header.b=ioZQMXyK; spf=pass (domain: redhat.com, ip: 205.139.110.120, mailfrom: lersek@redhat.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1589284383; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=maWLloKJSpTL55oNsATCtbv957L6KgWszEo4czZDol8=; b=ioZQMXyKgLM36avUv2TBwVfiKH74nhLt5uTN2IRmecFqsaSPVNtFZpLwwkk8sqTHxMBuHd 6xKCX+Bd++b9g+RrmsFK2X4eZmcTcX+qZCPza84FeLTFQ7TdGhj4y51TB4/2xvVsENzO2h aj+Gegnh1IAh73ahqBhAw9VINwOqV/I= Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-212-2dcarhxkPWGipCFKV0CZ_w-1; Tue, 12 May 2020 07:52:59 -0400 X-MC-Unique: 2dcarhxkPWGipCFKV0CZ_w-1 Received: from smtp.corp.redhat.com (int-mx06.intmail.prod.int.phx2.redhat.com [10.5.11.16]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id BF0BC475; Tue, 12 May 2020 11:52:56 +0000 (UTC) Received: from lacos-laptop-7.usersys.redhat.com (ovpn-114-120.ams2.redhat.com [10.36.114.120]) by smtp.corp.redhat.com (Postfix) with ESMTP id 55E565C1B5; Tue, 12 May 2020 11:52:52 +0000 (UTC) Subject: Re: [edk2-devel] [PATCH v2 00/12] Add the VariablePolicy feature To: devel@edk2.groups.io, michael.kubacki@outlook.com Cc: Jiewen Yao , Chao Zhang , Jian J Wang , Hao A Wu , Liming Gao , Jordan Justen , Ard Biesheuvel , Andrew Fish , Ray Ni , Anthony Perard , Julien Grall , Maurice Ma , Guo Dong , Benjamin You References: From: "Laszlo Ersek" Message-ID: <11a89bca-ea96-9ba0-2177-e995b98e6943@redhat.com> Date: Tue, 12 May 2020 13:52:52 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.9.1 MIME-Version: 1.0 In-Reply-To: X-Scanned-By: MIMEDefang 2.79 on 10.5.11.16 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Language: en-US Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit On 05/12/20 08:46, Michael Kubacki wrote: > From: Michael Kubacki > > REF:https://bugzilla.tianocore.org/show_bug.cgi?id=2522 > > The 12 patches in this series add the VariablePolicy feature to the core, > deprecate Edk2VarLock (while adding a compatibility layer to reduce code > churn), and integrate the VariablePolicy libraries and protocols into > Variable Services. > > Since the integration requires multiple changes, including adding libraries, > a protocol, an SMI communication handler, and VariableServices integration, > the patches are broken up by individual library additions and then a final > integration. Security-sensitive changes like bypassing Authenticated > Variable enforcement are also broken out into individual patches so that > attention can be called directly to them. > > Platform porting instructions are described in this wiki entry: > https://github.com/tianocore/tianocore.github.io/wiki/VariablePolicy-Protocol---Enhanced-Method-for-Managing-Variables#platform-porting (1) This wiki article is helpful, thanks. I have one remark: there's a heading saying "VarCheckPolicyLib NULL Instance": https://github.com/tianocore/tianocore.github.io/wiki/VariablePolicy-Protocol---Enhanced-Method-for-Managing-Variables#varcheckpolicylib-null-instance I think what's meant is "NULL class", not "NULL instance". (2) The following platform DSC files in edk2 include the non-SMM variable driver ("MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf"), but they are not modified by this patch series: ArmVirtPkg/ArmVirtQemu.dsc ArmVirtPkg/ArmVirtQemuKernel.dsc ArmVirtPkg/ArmVirtXen.dsc OvmfPkg/OvmfXen.dsc UefiPayloadPkg/UefiPayloadPkgIa32.dsc UefiPayloadPkg/UefiPayloadPkgIa32X64.dsc I'm asking that you please (a) include a patch for ArmVirtPkg, (b) update the OvmfPkg patch to cover "OvmfXen.dsc" too. Not sure about the UefiPayloadPkg platforms; please ask their maintainers. (I've CC'd the OvmfXen and UefiPayloadPkg maintainers/reviewers.) Thanks, Laszlo > > Discussion of the feature can be found in multiple places throughout > the last year on the RFC channel, staging branches, and in devel. > > Most recently, this subject was discussed in this thread: > https://edk2.groups.io/g/devel/message/53712 > (the code branches shared in that discussion are now out of date, but the > whitepapers and discussion are relevant). > > Cc: Jiewen Yao > Cc: Chao Zhang > Cc: Jian J Wang > Cc: Hao A Wu > Cc: Liming Gao > Cc: Jordan Justen > Cc: Laszlo Ersek > Cc: Ard Biesheuvel > Cc: Andrew Fish > Cc: Ray Ni > Signed-off-by: Michael Kubacki > > Changes since v1: > * Fixed implementation for RuntimeDxe > * Add PCD to block DisableVariablePolicy > * Fix the DumpVariablePolicy pagination in SMM > > Bret Barkelew (12): > MdeModulePkg: Define the VariablePolicy protocol interface > MdeModulePkg: Define the VariablePolicyLib > MdeModulePkg: Define the VariablePolicyHelperLib > MdeModulePkg: Define the VarCheckPolicyLib and SMM interface > MdeModulePkg: Connect VariablePolicy business logic to > VariableServices > MdeModulePkg: Allow VariablePolicy state to delete protected variables > SecurityPkg: Allow VariablePolicy state to delete authenticated > variables > MdeModulePkg: Change TCG MOR variables to use VariablePolicy > MdeModulePkg: Drop VarLock from RuntimeDxe variable driver > MdeModulePkg: Add a shell-based functional test for VariablePolicy > OvmfPkg: Add VariablePolicy engine to OvmfPkg platform > EmulatorPkg: Add VariablePolicy engine to EmulatorPkg platform > > MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.c | 318 +++ > MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.c | 396 ++++ > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyExtraInitNull.c | 46 + > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyExtraInitRuntimeDxe.c | 85 + > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.c | 806 +++++++ > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyUnitTest/VariablePolicyUnitTest.c | 2285 ++++++++++++++++++++ > MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/VariablePolicyFuncTestApp.c | 1942 +++++++++++++++++ > MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockDxe.c | 52 +- > MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockSmm.c | 60 +- > MdeModulePkg/Universal/Variable/RuntimeDxe/VarCheck.c | 49 +- > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableDxe.c | 53 + > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableLockRequstToLock.c | 71 + > MdeModulePkg/Universal/Variable/RuntimeDxe/VariablePolicySmmDxe.c | 653 ++++++ > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDxe.c | 14 + > SecurityPkg/Library/AuthVariableLib/AuthService.c | 22 +- > EmulatorPkg/EmulatorPkg.dsc | 6 + > MdeModulePkg/Include/Guid/VarCheckPolicyMmi.h | 54 + > MdeModulePkg/Include/Library/VariablePolicyHelperLib.h | 164 ++ > MdeModulePkg/Include/Library/VariablePolicyLib.h | 207 ++ > MdeModulePkg/Include/Protocol/VariablePolicy.h | 157 ++ > MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.inf | 44 + > MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.uni | 12 + > MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.inf | 36 + > MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.uni | 12 + > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.inf | 44 + > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.uni | 12 + > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLibRuntimeDxe.inf | 52 + > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyUnitTest/VariablePolicyUnitTest.inf | 41 + > MdeModulePkg/MdeModulePkg.ci.yaml | 4 +- > MdeModulePkg/MdeModulePkg.dec | 26 +- > MdeModulePkg/MdeModulePkg.dsc | 15 + > MdeModulePkg/Test/MdeModulePkgHostTest.dsc | 11 + > MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/Readme.md | 55 + > MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/VariablePolicyFuncTestApp.inf | 42 + > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf | 5 + > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmm.inf | 4 + > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDxe.inf | 12 + > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableStandaloneMm.inf | 4 + > OvmfPkg/OvmfPkgIa32.dsc | 8 + > OvmfPkg/OvmfPkgIa32X64.dsc | 8 + > OvmfPkg/OvmfPkgX64.dsc | 8 + > SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf | 2 + > 42 files changed, 7819 insertions(+), 78 deletions(-) > create mode 100644 MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.c > create mode 100644 MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.c > create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyExtraInitNull.c > create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyExtraInitRuntimeDxe.c > create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.c > create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyUnitTest/VariablePolicyUnitTest.c > create mode 100644 MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/VariablePolicyFuncTestApp.c > create mode 100644 MdeModulePkg/Universal/Variable/RuntimeDxe/VariableLockRequstToLock.c > create mode 100644 MdeModulePkg/Universal/Variable/RuntimeDxe/VariablePolicySmmDxe.c > create mode 100644 MdeModulePkg/Include/Guid/VarCheckPolicyMmi.h > create mode 100644 MdeModulePkg/Include/Library/VariablePolicyHelperLib.h > create mode 100644 MdeModulePkg/Include/Library/VariablePolicyLib.h > create mode 100644 MdeModulePkg/Include/Protocol/VariablePolicy.h > create mode 100644 MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.inf > create mode 100644 MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.uni > create mode 100644 MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.inf > create mode 100644 MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.uni > create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.inf > create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.uni > create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLibRuntimeDxe.inf > create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyUnitTest/VariablePolicyUnitTest.inf > create mode 100644 MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/Readme.md > create mode 100644 MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/VariablePolicyFuncTestApp.inf >