From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pl1-f196.google.com (mail-pl1-f196.google.com [209.85.214.196]) by mx.groups.io with SMTP id smtpd.web12.1799.1592894705234590671 for ; Mon, 22 Jun 2020 23:45:05 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@corthon-com.20150623.gappssmtp.com header.s=20150623 header.b=Kg37de7W; spf=none, err=permanent DNS error (domain: corthon.com, ip: 209.85.214.196, mailfrom: bret@corthon.com) Received: by mail-pl1-f196.google.com with SMTP id 35so8723829ple.0 for ; Mon, 22 Jun 2020 23:45:05 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=corthon-com.20150623.gappssmtp.com; s=20150623; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=moKG7ir8LRY80w1rtryS2PS6055nj4tXN2w+N5eMS7g=; b=Kg37de7WNC0vJDiHv/KcnDCod0U/2koj4sDMwtdFwJVvbjz+AT7w0EqG1nJ+R3POeh t8+NdNCE9u3YGYCvkeBC87ucOPdmzC/hhOgEc9R87ZO5Vl8xaUxKgZN1FnDg0K45YSPQ dfIO+8qgoggDbW74cO4wckZ7bY/lkeR0dKAVeD/PfBbDAWIzoZw01KphvlMe5r/1FtGI K/K1DI318MtZWNyCJkHWzx3xv8anwvh+5tmgdmvJwrTZCqYMf8uXRWc4xVFzgigjOM22 djgSpLkn/VMN6DyOeOe5IEJJSSu5W5RGlTD3IK4bRJdyf4zn+mXo3amj5CMW63MQTN/f TbVQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=moKG7ir8LRY80w1rtryS2PS6055nj4tXN2w+N5eMS7g=; b=YPUpkrfn0kasjXayr4NucdB7FXg0OSLbYMCSlrsxZxwULOasGL6RrDBjpXcvhV0OGG Cj7KhfqxlMsL2mffuMN6W4XhOlIGBc52vrSGohHXOjUgoViMVWXOhGu1tXwko/o4aCwl 9t/0lbAaS/0Mj0FN7n6PV9+UQpDAI3GX44a+IjYOVEyAbu71Gqrjs1ymlPIEEya/fS77 qBDfYRQtZn3VlkunRLF25OG7Ir01UK6pRoUbyl1wKQyCnf3glUJy/IIh17yhDjUOivy3 0Fvyvs6S5XM7WfZeJSZDYSDrthbQhuSwKZzlMeNQMebP1Fjc3Kt+ujPh0GmTxUcVtQxS hing== X-Gm-Message-State: AOAM532rCYyyEPlCZPByX5z6XrvCIJzJHDDJEsn7EnH2bJlZQIiSUnJP jqETvBSQLOduwTH/j468vtud2kVDp7DBGg== X-Google-Smtp-Source: ABdhPJyhFTL0Q07FBdN4/9FLksVJWbPb6m8eWUzs27T6cvpU4muaAOGooeNs6xSO7Fqv7nQjZ89cfA== X-Received: by 2002:a17:902:201:: with SMTP id 1mr23184018plc.195.1592894704608; Mon, 22 Jun 2020 23:45:04 -0700 (PDT) Return-Path: Received: from localhost.localdomain (174-21-80-75.tukw.qwest.net. [174.21.80.75]) by smtp.gmail.com with ESMTPSA id d6sm1383818pjh.5.2020.06.22.23.45.03 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 22 Jun 2020 23:45:04 -0700 (PDT) From: "Bret Barkelew" X-Google-Original-From: Bret Barkelew To: devel@edk2.groups.io Cc: Jiewen Yao , Jian J Wang , Chao Zhang Subject: [PATCH v6 11/14] SecurityPkg: Allow VariablePolicy state to delete authenticated variables Date: Mon, 22 Jun 2020 23:41:01 -0700 Message-Id: <20200623064104.1908-12-brbarkel@microsoft.com> X-Mailer: git-send-email 2.26.2.windows.1.8.g01c50adf56.20200515075929 In-Reply-To: <20200623064104.1908-1-brbarkel@microsoft.com> References: <20200623064104.1908-1-brbarkel@microsoft.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable https://bugzilla.tianocore.org/show_bug.cgi?id=3D2522 Causes AuthService to check IsVariablePolicyEnabled() before enforcing write protections to allow variable deletion when policy engine is disabled. Only allows deletion, not modification. Cc: Jiewen Yao Cc: Jian J Wang Cc: Chao Zhang Cc: Bret Barkelew Signed-off-by: Bret Barkelew --- SecurityPkg/Library/AuthVariableLib/AuthService.c | 22 +++++++++++++= +++---- SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf | 2 ++ 2 files changed, 20 insertions(+), 4 deletions(-) diff --git a/SecurityPkg/Library/AuthVariableLib/AuthService.c b/SecurityPk= g/Library/AuthVariableLib/AuthService.c index 2f60331f2c04..aca9a5620c28 100644 --- a/SecurityPkg/Library/AuthVariableLib/AuthService.c +++ b/SecurityPkg/Library/AuthVariableLib/AuthService.c @@ -19,12 +19,16 @@ to verify the signature.=0D =0D Copyright (c) 2009 - 2019, Intel Corporation. All rights reserved.
=0D +Copyright (c) Microsoft Corporation.=0D SPDX-License-Identifier: BSD-2-Clause-Patent=0D =0D **/=0D =0D #include "AuthServiceInternal.h"=0D =0D +#include =0D +#include =0D +=0D //=0D // Public Exponent of RSA Key.=0D //=0D @@ -217,9 +221,12 @@ NeedPhysicallyPresent( IN EFI_GUID *VendorGuid=0D )=0D {=0D - if ((CompareGuid (VendorGuid, &gEfiSecureBootEnableDisableGuid) && (StrC= mp (VariableName, EFI_SECURE_BOOT_ENABLE_NAME) =3D=3D 0))=0D - || (CompareGuid (VendorGuid, &gEfiCustomModeEnableGuid) && (StrCmp (Va= riableName, EFI_CUSTOM_MODE_NAME) =3D=3D 0))) {=0D - return TRUE;=0D + // If the VariablePolicy engine is disabled, allow deletion of any authe= nticated variables.=0D + if (IsVariablePolicyEnabled()) {=0D + if ((CompareGuid (VendorGuid, &gEfiSecureBootEnableDisableGuid) && (St= rCmp (VariableName, EFI_SECURE_BOOT_ENABLE_NAME) =3D=3D 0))=0D + || (CompareGuid (VendorGuid, &gEfiCustomModeEnableGuid) && (StrCmp (= VariableName, EFI_CUSTOM_MODE_NAME) =3D=3D 0))) {=0D + return TRUE;=0D + }=0D }=0D =0D return FALSE;=0D @@ -842,7 +849,8 @@ ProcessVariable ( &OrgVariableInfo=0D );=0D =0D - if ((!EFI_ERROR (Status)) && IsDeleteAuthVariable (OrgVariableInfo.Attri= butes, Data, DataSize, Attributes) && UserPhysicalPresent()) {=0D + // If the VariablePolicy engine is disabled, allow deletion of any authe= nticated variables.=0D + if ((!EFI_ERROR (Status)) && IsDeleteAuthVariable (OrgVariableInfo.Attri= butes, Data, DataSize, Attributes) && (UserPhysicalPresent() || !IsVariable= PolicyEnabled())) {=0D //=0D // Allow the delete operation of common authenticated variable(AT or A= W) at user physical presence.=0D //=0D @@ -1960,6 +1968,12 @@ VerifyTimeBasedPayload ( =0D CopyMem (Buffer, PayloadPtr, PayloadSize);=0D =0D + // If the VariablePolicy engine is disabled, allow deletion of any authe= nticated variables.=0D + if (PayloadSize =3D=3D 0 && (Attributes & EFI_VARIABLE_APPEND_WRITE) =3D= =3D 0 && !IsVariablePolicyEnabled()) {=0D + VerifyStatus =3D TRUE;=0D + goto Exit;=0D + }=0D +=0D if (AuthVarType =3D=3D AuthVarTypePk) {=0D //=0D // Verify that the signature has been made with the current Platform K= ey (no chaining for PK).=0D diff --git a/SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf b/Secu= rityPkg/Library/AuthVariableLib/AuthVariableLib.inf index 8d4ce14df494..8eadeebcebd7 100644 --- a/SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf +++ b/SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf @@ -3,6 +3,7 @@ #=0D # Copyright (c) 2015 - 2016, Intel Corporation. All rights reserved.
= =0D # Copyright (c) 2018, ARM Limited. All rights reserved.
=0D +# Copyright (c) Microsoft Corporation.=0D #=0D # SPDX-License-Identifier: BSD-2-Clause-Patent=0D #=0D @@ -41,6 +42,7 @@ [LibraryClasses] MemoryAllocationLib=0D BaseCryptLib=0D PlatformSecureLib=0D + VariablePolicyLib=0D =0D [Guids]=0D ## CONSUMES ## Variable:L"SetupMode"=0D --=20 2.26.2.windows.1.8.g01c50adf56.20200515075929