From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pf1-f176.google.com (mail-pf1-f176.google.com [209.85.210.176]) by mx.groups.io with SMTP id smtpd.web12.720.1651687492960671066 for ; Wed, 04 May 2022 11:04:53 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20210112 header.b=Ph4Iz4en; spf=pass (domain: gmail.com, ip: 209.85.210.176, mailfrom: kuqin12@gmail.com) Received: by mail-pf1-f176.google.com with SMTP id j6so1715050pfe.13 for ; Wed, 04 May 2022 11:04:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=LmZJWZydPp0MKPxtYXe3B/Add0PKYXFkGihUfc5UToo=; b=Ph4Iz4enY2F+LdtZW8tMPWld+cr/pnXcKVO1fSGp2FtbSV6lnlL3+/K6XepkpclIp2 fN/99FCX6GzSFnArw7zDkXL0Xgh20bNg6SC3H4FF3iDRRxmZdyYNbpjCx0kPgXUGF6KZ SxdT6atkyyhqeTTbjhgega5ZaUmbnhgQR+6M41bepB8vx///B+FREY3Ss9Ypg0if9oT5 PNYWSj438UMFEx0ELkTJYqOKsjfabpWCwKkK0fE/RPUjK3U7WSxbcJCfxy0LssB4qs07 EIABSLD6DXwFz1cQxiDN25/vePD4k/lDuzOaBimjaH3QABcsic28KGyVofojAYVRbdPD cfvA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=LmZJWZydPp0MKPxtYXe3B/Add0PKYXFkGihUfc5UToo=; b=oeE4Ha+Eje3fUqQYoHOgxg/HE2MsNR8oYhSJGfa8Ndt87FMoFLWVUF65d+wqCOrU6c OUFtv88xsUDXYvaxb1p2FSpGCxBHYoCYg8vu/kpQDBMyvyEDWRs/oMrD3W/MG9NoS6G5 B3Qr5OMKNoP4GQtvYzcyPMPEKIYkPYUuD6dWM/FpnD5NZqWOQQ8cdnkRbqoox1mZUYlO 6+e4LeKOPYyOx/+jXxvWtTKIpypGj6qnHNOf98fNCnBqVnf5pzz97X+sEh6jSPRv2nKD KtC4w51kK3WoM7La+jVr2pRy/gjICoM04AAXeerjbs9TlZi2EGkka15E1BSYRYYUXiTq 5V5w== X-Gm-Message-State: AOAM530EZ0oXaEgdbi/5grSmU1JE1wkfCmtwK7YcghPk+ufY/5l76ByR EpMkH4qf+5V93xaWlsY55uCRaEtve3qRPw== X-Google-Smtp-Source: ABdhPJxT0Yrtl1jiIiQM2a3qzEXHLd4Ro1otlFVblP9V61Dg+owIL6KRYerPi7Yuets+ZNbBMNY1NQ== X-Received: by 2002:a65:5548:0:b0:3c1:f140:6ab4 with SMTP id t8-20020a655548000000b003c1f1406ab4mr16007772pgr.20.1651687492397; Wed, 04 May 2022 11:04:52 -0700 (PDT) Return-Path: Received: from localhost.localdomain ([50.47.82.110]) by smtp.gmail.com with ESMTPSA id n5-20020aa79045000000b0050dc7628143sm8496347pfo.29.2022.05.04.11.04.51 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 04 May 2022 11:04:51 -0700 (PDT) From: "Kun Qin" To: devel@edk2.groups.io Cc: Jiewen Yao , Jian J Wang , Min Xu Subject: [PATCH v1 02/11] SecurityPkg: PlatformPKProtectionLib: Added PK protection interface Date: Wed, 4 May 2022 11:04:28 -0700 Message-Id: <20220504180438.1321-3-kuqin12@gmail.com> X-Mailer: git-send-email 2.35.1.windows.2 In-Reply-To: <20220504180438.1321-1-kuqin12@gmail.com> References: <20220504180438.1321-1-kuqin12@gmail.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: Kun Qin REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3911 This patch provides an abstracted interface for platform to implement PK variable related protection interface, which is designed to be used when PK variable is about to be changed by UEFI firmware. This change also provided a variable policy based library implementation to accomodate platforms that supports variable policy for variable protections. Cc: Jiewen Yao Cc: Jian J Wang Cc: Min Xu Signed-off-by: Kun Qin --- SecurityPkg/Library/PlatformPKProtectionLibVarPolicy/PlatformPKProtectionLibVarPolicy.c | 51 ++++++++++++++++++++ SecurityPkg/Include/Library/PlatformPKProtectionLib.h | 31 ++++++++++++ SecurityPkg/Library/PlatformPKProtectionLibVarPolicy/PlatformPKProtectionLibVarPolicy.inf | 36 ++++++++++++++ SecurityPkg/SecurityPkg.dec | 5 ++ SecurityPkg/SecurityPkg.dsc | 2 + 5 files changed, 125 insertions(+) diff --git a/SecurityPkg/Library/PlatformPKProtectionLibVarPolicy/PlatformPKProtectionLibVarPolicy.c b/SecurityPkg/Library/PlatformPKProtectionLibVarPolicy/PlatformPKProtectionLibVarPolicy.c new file mode 100644 index 000000000000..a2649242246f --- /dev/null +++ b/SecurityPkg/Library/PlatformPKProtectionLibVarPolicy/PlatformPKProtectionLibVarPolicy.c @@ -0,0 +1,51 @@ +/** @file + Provides an abstracted interface for configuring PK related variable protection. + + Copyright (c) Microsoft Corporation. + SPDX-License-Identifier: BSD-2-Clause-Patent + +**/ +#include +#include + +#include +#include + +/** + Disable any applicable protection against variable 'PK'. The implementation + of this interface is platform specific, depending on the protection techniques + used per platform. + + Note: It is the platform's responsibility to conduct cautious operation after + disabling this protection. + + @retval EFI_SUCCESS State has been successfully updated. + @retval Others Error returned from implementation specific + underying APIs. + +**/ +EFI_STATUS +EFIAPI +DisablePKProtection ( + VOID + ) +{ + EFI_STATUS Status; + EDKII_VARIABLE_POLICY_PROTOCOL *VariablePolicy; + + DEBUG ((DEBUG_INFO, "%a() Entry...\n", __FUNCTION__)); + + // IMPORTANT NOTE: This operation is sticky and leaves variable protections disabled. + // The system *MUST* be reset after performing this operation. + Status = gBS->LocateProtocol (&gEdkiiVariablePolicyProtocolGuid, NULL, (VOID **)&VariablePolicy); + if (!EFI_ERROR (Status)) { + Status = VariablePolicy->DisableVariablePolicy (); + // EFI_ALREADY_STARTED means that everything is currently disabled. + // This should be considered SUCCESS. + if (Status == EFI_ALREADY_STARTED) { + Status = EFI_SUCCESS; + } + } + + return Status; +} diff --git a/SecurityPkg/Include/Library/PlatformPKProtectionLib.h b/SecurityPkg/Include/Library/PlatformPKProtectionLib.h new file mode 100644 index 000000000000..3586a47b77c2 --- /dev/null +++ b/SecurityPkg/Include/Library/PlatformPKProtectionLib.h @@ -0,0 +1,31 @@ +/** @file + Provides an abstracted interface for configuring PK related variable protection. + + Copyright (c) Microsoft Corporation. + SPDX-License-Identifier: BSD-2-Clause-Patent + +**/ + +#ifndef PLATFORM_PK_PROTECTION_LIB_H_ +#define PLATFORM_PK_PROTECTION_LIB_H_ + +/** + Disable any applicable protection against variable 'PK'. The implementation + of this interface is platform specific, depending on the protection techniques + used per platform. + + Note: It is the platform's responsibility to conduct cautious operation after + disabling this protection. + + @retval EFI_SUCCESS State has been successfully updated. + @retval Others Error returned from implementation specific + underying APIs. + +**/ +EFI_STATUS +EFIAPI +DisablePKProtection ( + VOID + ); + +#endif diff --git a/SecurityPkg/Library/PlatformPKProtectionLibVarPolicy/PlatformPKProtectionLibVarPolicy.inf b/SecurityPkg/Library/PlatformPKProtectionLibVarPolicy/PlatformPKProtectionLibVarPolicy.inf new file mode 100644 index 000000000000..df42ce06c019 --- /dev/null +++ b/SecurityPkg/Library/PlatformPKProtectionLibVarPolicy/PlatformPKProtectionLibVarPolicy.inf @@ -0,0 +1,36 @@ +## @file +# Provides an abstracted interface for configuring PK related variable protection. +# +# Copyright (c) Microsoft Corporation. +# SPDX-License-Identifier: BSD-2-Clause-Patent +# +## + +[Defines] + INF_VERSION = 0x00010005 + BASE_NAME = PlatformPKProtectionLibVarPolicy + FILE_GUID = AE0C5992-526C-4518-93BA-3C2611B801E0 + MODULE_TYPE = DXE_DRIVER + VERSION_STRING = 1.0 + LIBRARY_CLASS = PlatformPKProtectionLib|DXE_DRIVER DXE_RUNTIME_DRIVER UEFI_APPLICATION + +# +# The following information is for reference only and not required by the build tools. +# +# VALID_ARCHITECTURES = IA32 X64 AARCH64 +# + +[Sources] + PlatformPKProtectionLibVarPolicy.c + +[Packages] + MdePkg/MdePkg.dec + MdeModulePkg/MdeModulePkg.dec + SecurityPkg/SecurityPkg.dec + +[LibraryClasses] + DebugLib + UefiBootServicesTableLib + +[Protocols] + gEdkiiVariablePolicyProtocolGuid diff --git a/SecurityPkg/SecurityPkg.dec b/SecurityPkg/SecurityPkg.dec index 9f7a032d60d5..b8fb1964dcf3 100644 --- a/SecurityPkg/SecurityPkg.dec +++ b/SecurityPkg/SecurityPkg.dec @@ -99,6 +99,11 @@ [LibraryClasses] ## @libraryclass Provides support to enroll Secure Boot keys. # SecureBootVariableProvisionLib|Include/Library/SecureBootVariableProvisionLib.h + + ## @libraryclass Provides support to manage variable 'PK' related protections. + # + PlatformPKProtectionLib|Include/Library/PlatformPKProtectionLib.h + [Guids] ## Security package token space guid. # Include/Guid/SecurityPkgTokenSpace.h diff --git a/SecurityPkg/SecurityPkg.dsc b/SecurityPkg/SecurityPkg.dsc index 73a93c2285b1..5029cd29aff4 100644 --- a/SecurityPkg/SecurityPkg.dsc +++ b/SecurityPkg/SecurityPkg.dsc @@ -71,6 +71,7 @@ [LibraryClasses] TcgEventLogRecordLib|SecurityPkg/Library/TcgEventLogRecordLib/TcgEventLogRecordLib.inf MmUnblockMemoryLib|MdePkg/Library/MmUnblockMemoryLib/MmUnblockMemoryLibNull.inf SecureBootVariableLib|SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.inf + PlatformPKProtectionLib|SecurityPkg/Library/PlatformPKProtectionLibVarPolicy/PlatformPKProtectionLibVarPolicy.inf SecureBootVariableProvisionLib|SecurityPkg/Library/SecureBootVariableProvisionLib/SecureBootVariableProvisionLib.inf [LibraryClasses.ARM, LibraryClasses.AARCH64] @@ -253,6 +254,7 @@ [Components] # SecurityPkg/Library/VariableKeyLibNull/VariableKeyLibNull.inf SecurityPkg/Library/RpmcLibNull/RpmcLibNull.inf + SecurityPkg/Library/PlatformPKProtectionLibVarPolicy/PlatformPKProtectionLibVarPolicy.inf # # Other -- 2.34.1.windows.1