From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pj1-f68.google.com (mail-pj1-f68.google.com [209.85.216.68]) by mx.groups.io with SMTP id smtpd.web11.41295.1591029216248348300 for ; Mon, 01 Jun 2020 09:33:36 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@corthon-com.20150623.gappssmtp.com header.s=20150623 header.b=DhOLevA1; spf=none, err=permanent DNS error (domain: corthon.com, ip: 209.85.216.68, mailfrom: bret@corthon.com) Received: by mail-pj1-f68.google.com with SMTP id a45so122549pje.1 for ; Mon, 01 Jun 2020 09:33:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=corthon-com.20150623.gappssmtp.com; s=20150623; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=moKG7ir8LRY80w1rtryS2PS6055nj4tXN2w+N5eMS7g=; b=DhOLevA1NpmNoPg21MwiUUucXqiRK7eQiP2no/rfuMGMAoQvos4vZo3Nuqae7pUBrF I15+YEJdy8vE+cGcqD7qcblFPGSq4UgE36lw1ApvCuzWFLkyH8qw5M8e1xeYrGLas16n R1N4PYA5g7OEKzFPD1YlN9qaq0a9akQ9tqDxroEIVbOm2S9HjTwADHtQZc/MT+pxgU2j Z5QVAg6muaxLAkgKRVdsba70feoy4fMbtEilqgABE4CljRPDLFCzobn30OaHOHOi8avA ENnEJPIcYw4vdL8D57kFEgTS9x0Our5P3038KnQOmU5t5UQVZhRVgavf9XdjZu60Y4eg /+dQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=moKG7ir8LRY80w1rtryS2PS6055nj4tXN2w+N5eMS7g=; b=OPCdW9t2FW9w4HOqXwxuICZd3Mah+IWyMCWGnJ679SlKCHe+0P2NpVWIpkdf95j4/L iYNIVyOApnyBM6EHtcCKRrpEuE2nYzAy46ul74b7ehtnp4wyx9oQXe3h63zKE2xgfX1g wpOwIAPXHzZ+bKKOAZvlN0+IpDdTnArcNhBvN2YBp0f+QflZ8YvlDn0fgGbkX4lLh2fS hXpogFSOKPOM8af7zz6LnVAQLjToip+oCy2ajBmhkRTvb5/jRLKaWJnvYauboY2awhG8 W/rU3jEyVJu6rMPoZ1Mz9eipc6qFLT6kkt9HIUbh0yA3UJsPXz4xAp8MQW+q1dq3yBg8 Aviw== X-Gm-Message-State: AOAM531QpJ9ze7Su6jy2u3Hi6A1DLrze0VnI5X2mtNJjqy2FswxPVGvj jjB3kCu9Spo/6ItsitklLNVghjYDcWo= X-Google-Smtp-Source: ABdhPJxSMKHiEaVzdJKlxtoRKER22HoT2/n8sEBI39g90cm6gsA1BVln+/tCQGHwKynswP/f88fJkg== X-Received: by 2002:a17:90a:ad86:: with SMTP id s6mr203431pjq.193.1591029215600; Mon, 01 Jun 2020 09:33:35 -0700 (PDT) Return-Path: Received: from localhost.localdomain ([71.212.144.72]) by smtp.gmail.com with ESMTPSA id np5sm91178pjb.43.2020.06.01.09.33.34 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 01 Jun 2020 09:33:35 -0700 (PDT) From: Bret Barkelew X-Google-Original-From: Bret Barkelew To: devel@edk2.groups.io Cc: Jiewen Yao , Jian J Wang , Chao Zhang Subject: [PATCH v4 11/14] SecurityPkg: Allow VariablePolicy state to delete authenticated variables Date: Mon, 1 Jun 2020 09:33:07 -0700 Message-Id: <20200601163310.1718-12-brbarkel@microsoft.com> X-Mailer: git-send-email 2.26.2.windows.1.8.g01c50adf56.20200515075929 In-Reply-To: <20200601163310.1718-1-brbarkel@microsoft.com> References: <20200601163310.1718-1-brbarkel@microsoft.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable https://bugzilla.tianocore.org/show_bug.cgi?id=3D2522 Causes AuthService to check IsVariablePolicyEnabled() before enforcing write protections to allow variable deletion when policy engine is disabled. Only allows deletion, not modification. Cc: Jiewen Yao Cc: Jian J Wang Cc: Chao Zhang Cc: Bret Barkelew Signed-off-by: Bret Barkelew --- SecurityPkg/Library/AuthVariableLib/AuthService.c | 22 +++++++++++++= +++---- SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf | 2 ++ 2 files changed, 20 insertions(+), 4 deletions(-) diff --git a/SecurityPkg/Library/AuthVariableLib/AuthService.c b/SecurityPk= g/Library/AuthVariableLib/AuthService.c index 2f60331f2c04..aca9a5620c28 100644 --- a/SecurityPkg/Library/AuthVariableLib/AuthService.c +++ b/SecurityPkg/Library/AuthVariableLib/AuthService.c @@ -19,12 +19,16 @@ to verify the signature.=0D =0D Copyright (c) 2009 - 2019, Intel Corporation. All rights reserved.
=0D +Copyright (c) Microsoft Corporation.=0D SPDX-License-Identifier: BSD-2-Clause-Patent=0D =0D **/=0D =0D #include "AuthServiceInternal.h"=0D =0D +#include =0D +#include =0D +=0D //=0D // Public Exponent of RSA Key.=0D //=0D @@ -217,9 +221,12 @@ NeedPhysicallyPresent( IN EFI_GUID *VendorGuid=0D )=0D {=0D - if ((CompareGuid (VendorGuid, &gEfiSecureBootEnableDisableGuid) && (StrC= mp (VariableName, EFI_SECURE_BOOT_ENABLE_NAME) =3D=3D 0))=0D - || (CompareGuid (VendorGuid, &gEfiCustomModeEnableGuid) && (StrCmp (Va= riableName, EFI_CUSTOM_MODE_NAME) =3D=3D 0))) {=0D - return TRUE;=0D + // If the VariablePolicy engine is disabled, allow deletion of any authe= nticated variables.=0D + if (IsVariablePolicyEnabled()) {=0D + if ((CompareGuid (VendorGuid, &gEfiSecureBootEnableDisableGuid) && (St= rCmp (VariableName, EFI_SECURE_BOOT_ENABLE_NAME) =3D=3D 0))=0D + || (CompareGuid (VendorGuid, &gEfiCustomModeEnableGuid) && (StrCmp (= VariableName, EFI_CUSTOM_MODE_NAME) =3D=3D 0))) {=0D + return TRUE;=0D + }=0D }=0D =0D return FALSE;=0D @@ -842,7 +849,8 @@ ProcessVariable ( &OrgVariableInfo=0D );=0D =0D - if ((!EFI_ERROR (Status)) && IsDeleteAuthVariable (OrgVariableInfo.Attri= butes, Data, DataSize, Attributes) && UserPhysicalPresent()) {=0D + // If the VariablePolicy engine is disabled, allow deletion of any authe= nticated variables.=0D + if ((!EFI_ERROR (Status)) && IsDeleteAuthVariable (OrgVariableInfo.Attri= butes, Data, DataSize, Attributes) && (UserPhysicalPresent() || !IsVariable= PolicyEnabled())) {=0D //=0D // Allow the delete operation of common authenticated variable(AT or A= W) at user physical presence.=0D //=0D @@ -1960,6 +1968,12 @@ VerifyTimeBasedPayload ( =0D CopyMem (Buffer, PayloadPtr, PayloadSize);=0D =0D + // If the VariablePolicy engine is disabled, allow deletion of any authe= nticated variables.=0D + if (PayloadSize =3D=3D 0 && (Attributes & EFI_VARIABLE_APPEND_WRITE) =3D= =3D 0 && !IsVariablePolicyEnabled()) {=0D + VerifyStatus =3D TRUE;=0D + goto Exit;=0D + }=0D +=0D if (AuthVarType =3D=3D AuthVarTypePk) {=0D //=0D // Verify that the signature has been made with the current Platform K= ey (no chaining for PK).=0D diff --git a/SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf b/Secu= rityPkg/Library/AuthVariableLib/AuthVariableLib.inf index 8d4ce14df494..8eadeebcebd7 100644 --- a/SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf +++ b/SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf @@ -3,6 +3,7 @@ #=0D # Copyright (c) 2015 - 2016, Intel Corporation. All rights reserved.
= =0D # Copyright (c) 2018, ARM Limited. All rights reserved.
=0D +# Copyright (c) Microsoft Corporation.=0D #=0D # SPDX-License-Identifier: BSD-2-Clause-Patent=0D #=0D @@ -41,6 +42,7 @@ [LibraryClasses] MemoryAllocationLib=0D BaseCryptLib=0D PlatformSecureLib=0D + VariablePolicyLib=0D =0D [Guids]=0D ## CONSUMES ## Variable:L"SetupMode"=0D --=20 2.26.2.windows.1.8.g01c50adf56.20200515075929