From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pj1-f48.google.com (mail-pj1-f48.google.com [209.85.216.48]) by mx.groups.io with SMTP id smtpd.web12.37095.1598593922122555353 for ; Thu, 27 Aug 2020 22:52:02 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@corthon-com.20150623.gappssmtp.com header.s=20150623 header.b=cOyfmunz; spf=none, err=permanent DNS error (domain: corthon.com, ip: 209.85.216.48, mailfrom: bret@corthon.com) Received: by mail-pj1-f48.google.com with SMTP id n3so93323pjq.1 for ; Thu, 27 Aug 2020 22:52:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=corthon-com.20150623.gappssmtp.com; s=20150623; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=bYdD8yJmOpnUuPFDaiUdLsMyS3zm0sIP11EHCBkycD0=; b=cOyfmunzwUls98gcYopL95ErDsl3C+Txv8hjc206ijmjqUO1EedxdeTFXq0DACqHCU UbPEkz6/6Nbg0kDgoIUyza7WByvgqf2gO8of5Kya72RN0C49RSa+jZpAT+lXd9npyfkz jo06zcMqOzIyTt0hls2i6nwphZolm+2Raq6MoeV9gd3sqVKSJ8HX5Q3UtMUDzgqf/+Eo qFBXGYUzlM1c0AT/4VBn4sd3efSMKs1GcDqb9XybZtN8cq61e+RIcT5PrbH2UUEZAEBk uvO1lVioJG/69dHadpAy3cmx3WRy6f+4Ng65suCt6VP2QjsTOk6UIkrsKKha1n3XgTat wtug== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=bYdD8yJmOpnUuPFDaiUdLsMyS3zm0sIP11EHCBkycD0=; b=PaXL+1ZOdbkKmZPPuVXngtNsi/HLvZcU2K7NEaYc2lK4EFhF7aJbnFcoBJqH+hDqap MEANDriwEJY9YetrODSuH0+AMU4cicBijPB10QZjRl8sWmC2iVKEMn6RzGSm+EHEG91B mf+caEAgR5QJ7kwI2+rlCIzjJFWRwS4JhDU+scNkO70vcSu5DFsJ0Fv9RHnGk8OrzpvS AA0yLgURL5MkRI0LFTnPgvWqS1XwBHOVoTw25Mc6+XBZ4S4g/IYvyOJgsOYWdaMRZRXT n9rxAu//h/jexcwcm/FaEza06MKiKYVoQlefXHHfMzYiUhvj+4KAjWWEsQBuTQ/lJ3dX RKLA== X-Gm-Message-State: AOAM531ZrqmRUvi8oNFksvlBCRTXQu+FGRA8505tJxwXY8s5XLfRSMkC LY2NbTH3g6zgWMI5Zklge5CGy6+QwHzU6948Nkw= X-Google-Smtp-Source: ABdhPJz0FILRoaCWEhNUdWYf+Q+CizWDxXLQu0DpaqRRIfcqZm87wNU6NIdUgxBeIJ7gOHPQpZNkmw== X-Received: by 2002:a17:90b:ec1:: with SMTP id gz1mr267067pjb.48.1598593921308; Thu, 27 Aug 2020 22:52:01 -0700 (PDT) Return-Path: Received: from localhost.localdomain (174-21-132-206.tukw.qwest.net. [174.21.132.206]) by smtp.gmail.com with ESMTPSA id fz19sm41802pjb.40.2020.08.27.22.52.00 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 27 Aug 2020 22:52:00 -0700 (PDT) From: "Bret Barkelew" X-Google-Original-From: Bret Barkelew To: devel@edk2.groups.io Cc: Jiewen Yao , Jian J Wang , Chao Zhang Subject: [PATCH v7 11/14] SecurityPkg: Allow VariablePolicy state to delete authenticated variables Date: Thu, 27 Aug 2020 22:51:24 -0700 Message-Id: <20200828055127.1610-12-brbarkel@microsoft.com> X-Mailer: git-send-email 2.28.0.windows.1 In-Reply-To: <20200828055127.1610-1-brbarkel@microsoft.com> References: <20200828055127.1610-1-brbarkel@microsoft.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable https://bugzilla.tianocore.org/show_bug.cgi?id=3D2522 Causes AuthService to check IsVariablePolicyEnabled() before enforcing write protections to allow variable deletion when policy engine is disabled. Only allows deletion, not modification. Cc: Jiewen Yao Cc: Jian J Wang Cc: Chao Zhang Cc: Bret Barkelew Signed-off-by: Bret Barkelew --- SecurityPkg/Library/AuthVariableLib/AuthService.c | 22 +++++++++++++= +++---- SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf | 2 ++ 2 files changed, 20 insertions(+), 4 deletions(-) diff --git a/SecurityPkg/Library/AuthVariableLib/AuthService.c b/SecurityPk= g/Library/AuthVariableLib/AuthService.c index 2f60331f2c04..aca9a5620c28 100644 --- a/SecurityPkg/Library/AuthVariableLib/AuthService.c +++ b/SecurityPkg/Library/AuthVariableLib/AuthService.c @@ -19,12 +19,16 @@ to verify the signature.=0D =0D Copyright (c) 2009 - 2019, Intel Corporation. All rights reserved.
=0D +Copyright (c) Microsoft Corporation.=0D SPDX-License-Identifier: BSD-2-Clause-Patent=0D =0D **/=0D =0D #include "AuthServiceInternal.h"=0D =0D +#include =0D +#include =0D +=0D //=0D // Public Exponent of RSA Key.=0D //=0D @@ -217,9 +221,12 @@ NeedPhysicallyPresent( IN EFI_GUID *VendorGuid=0D )=0D {=0D - if ((CompareGuid (VendorGuid, &gEfiSecureBootEnableDisableGuid) && (StrC= mp (VariableName, EFI_SECURE_BOOT_ENABLE_NAME) =3D=3D 0))=0D - || (CompareGuid (VendorGuid, &gEfiCustomModeEnableGuid) && (StrCmp (Va= riableName, EFI_CUSTOM_MODE_NAME) =3D=3D 0))) {=0D - return TRUE;=0D + // If the VariablePolicy engine is disabled, allow deletion of any authe= nticated variables.=0D + if (IsVariablePolicyEnabled()) {=0D + if ((CompareGuid (VendorGuid, &gEfiSecureBootEnableDisableGuid) && (St= rCmp (VariableName, EFI_SECURE_BOOT_ENABLE_NAME) =3D=3D 0))=0D + || (CompareGuid (VendorGuid, &gEfiCustomModeEnableGuid) && (StrCmp (= VariableName, EFI_CUSTOM_MODE_NAME) =3D=3D 0))) {=0D + return TRUE;=0D + }=0D }=0D =0D return FALSE;=0D @@ -842,7 +849,8 @@ ProcessVariable ( &OrgVariableInfo=0D );=0D =0D - if ((!EFI_ERROR (Status)) && IsDeleteAuthVariable (OrgVariableInfo.Attri= butes, Data, DataSize, Attributes) && UserPhysicalPresent()) {=0D + // If the VariablePolicy engine is disabled, allow deletion of any authe= nticated variables.=0D + if ((!EFI_ERROR (Status)) && IsDeleteAuthVariable (OrgVariableInfo.Attri= butes, Data, DataSize, Attributes) && (UserPhysicalPresent() || !IsVariable= PolicyEnabled())) {=0D //=0D // Allow the delete operation of common authenticated variable(AT or A= W) at user physical presence.=0D //=0D @@ -1960,6 +1968,12 @@ VerifyTimeBasedPayload ( =0D CopyMem (Buffer, PayloadPtr, PayloadSize);=0D =0D + // If the VariablePolicy engine is disabled, allow deletion of any authe= nticated variables.=0D + if (PayloadSize =3D=3D 0 && (Attributes & EFI_VARIABLE_APPEND_WRITE) =3D= =3D 0 && !IsVariablePolicyEnabled()) {=0D + VerifyStatus =3D TRUE;=0D + goto Exit;=0D + }=0D +=0D if (AuthVarType =3D=3D AuthVarTypePk) {=0D //=0D // Verify that the signature has been made with the current Platform K= ey (no chaining for PK).=0D diff --git a/SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf b/Secu= rityPkg/Library/AuthVariableLib/AuthVariableLib.inf index 8d4ce14df494..8eadeebcebd7 100644 --- a/SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf +++ b/SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf @@ -3,6 +3,7 @@ #=0D # Copyright (c) 2015 - 2016, Intel Corporation. All rights reserved.
= =0D # Copyright (c) 2018, ARM Limited. All rights reserved.
=0D +# Copyright (c) Microsoft Corporation.=0D #=0D # SPDX-License-Identifier: BSD-2-Clause-Patent=0D #=0D @@ -41,6 +42,7 @@ [LibraryClasses] MemoryAllocationLib=0D BaseCryptLib=0D PlatformSecureLib=0D + VariablePolicyLib=0D =0D [Guids]=0D ## CONSUMES ## Variable:L"SetupMode"=0D --=20 2.28.0.windows.1