From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mga09.intel.com (mga09.intel.com [134.134.136.24]) by ml01.01.org (Postfix) with ESMTP id D5B3C1A1E0F for ; Mon, 15 Aug 2016 19:54:01 -0700 (PDT) Received: from orsmga001.jf.intel.com ([10.7.209.18]) by orsmga102.jf.intel.com with ESMTP; 15 Aug 2016 19:54:03 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.28,528,1464678000"; d="scan'208";a="1014961303" Received: from fmsmsx106.amr.corp.intel.com ([10.18.124.204]) by orsmga001.jf.intel.com with ESMTP; 15 Aug 2016 19:54:01 -0700 Received: from fmsmsx102.amr.corp.intel.com (10.18.124.200) by FMSMSX106.amr.corp.intel.com (10.18.124.204) with Microsoft SMTP Server (TLS) id 14.3.248.2; Mon, 15 Aug 2016 19:54:01 -0700 Received: from shsmsx152.ccr.corp.intel.com (10.239.6.52) by FMSMSX102.amr.corp.intel.com (10.18.124.200) with Microsoft SMTP Server (TLS) id 14.3.248.2; Mon, 15 Aug 2016 19:54:00 -0700 Received: from shsmsx102.ccr.corp.intel.com ([169.254.2.147]) by SHSMSX152.ccr.corp.intel.com ([169.254.6.107]) with mapi id 14.03.0248.002; Tue, 16 Aug 2016 10:53:59 +0800 From: "Fu, Siyuan" To: "Zhang, Chao B" , "edk2-devel@lists.01.org" CC: "Zhang, Chao B" , "Zeng, Star" Thread-Topic: [edk2] [PATCH V1] SecurityPkg: AuthVariableLib: Fix potential inconsistency corner case for Time Auth variable Thread-Index: AQHR92deQsiuNtHtuUWzNT6DHN9zdKBK5AZg Date: Tue, 16 Aug 2016 02:53:58 +0000 Message-ID: References: <1471315139-19308-1-git-send-email-chao.b.zhang@intel.com> In-Reply-To: <1471315139-19308-1-git-send-email-chao.b.zhang@intel.com> Accept-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ctpclassification: CTP_IC x-titus-metadata-40: eyJDYXRlZ29yeUxhYmVscyI6IiIsIk1ldGFkYXRhIjp7Im5zIjoiaHR0cDpcL1wvd3d3LnRpdHVzLmNvbVwvbnNcL0ludGVsMyIsImlkIjoiZjE2MDBlZmItOWE5Ni00YjJiLWI4N2ItMThhODI5OGI3ZDFlIiwicHJvcHMiOlt7Im4iOiJDVFBDbGFzc2lmaWNhdGlvbiIsInZhbHMiOlt7InZhbHVlIjoiQ1RQX0lDIn1dfV19LCJTdWJqZWN0TGFiZWxzIjpbXSwiVE1DVmVyc2lvbiI6IjE1LjkuNi42IiwiVHJ1c3RlZExhYmVsSGFzaCI6IlJsNFMwZ2I0aUhST2NTM1wvbXZOZnRRQlNuY0o1YTZnXC8yQ3ZONEU1dCtSRT0ifQ== x-originating-ip: [10.239.127.40] MIME-Version: 1.0 Subject: Re: [PATCH V1] SecurityPkg: AuthVariableLib: Fix potential inconsistency corner case for Time Auth variable X-BeenThere: edk2-devel@lists.01.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: EDK II Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 16 Aug 2016 02:54:02 -0000 Content-Language: en-US Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Reviewed-by: Fu Siyuan > -----Original Message----- > From: edk2-devel [mailto:edk2-devel-bounces@lists.01.org] On Behalf Of > Zhang, Chao B > Sent: Tuesday, August 16, 2016 10:39 AM > To: edk2-devel@lists.01.org > Cc: Fu, Siyuan ; Zhang, Chao B > ; Zeng, Star > Subject: [edk2] [PATCH V1] SecurityPkg: AuthVariableLib: Fix potential > inconsistency corner case for Time Auth variable >=20 > 2 steps are used to create/delete a time based variable. For create, > step 1: Insert Signer Cert to CertDB. Step 2: Insert Payload to Variable. > For delete, step 1: Delete Variable. Step 2: Delete Cert from CertDB. > System may breaks between step 1 & step 2, so CertDB may contains useless > Cert in the next reboot. AuthVariableLib choose to sync consistent state > between CertDB & Time Auth Variable on initialization. However, it doesn'= t > apply Time Auth attribute check. Now add it. >=20 > Contributed-under: TianoCore Contribution Agreement 1.0 > Signed-off-by: Chao Zhang > --- > SecurityPkg/Library/AuthVariableLib/AuthService.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) >=20 > diff --git a/SecurityPkg/Library/AuthVariableLib/AuthService.c > b/SecurityPkg/Library/AuthVariableLib/AuthService.c > index 6e1e284..b013d42 100644 > --- a/SecurityPkg/Library/AuthVariableLib/AuthService.c > +++ b/SecurityPkg/Library/AuthVariableLib/AuthService.c > @@ -2100,7 +2100,7 @@ CleanCertsFromDb ( > &AuthVariableInfo > ); >=20 > - if (EFI_ERROR(Status)) { > + if (EFI_ERROR(Status) || (AuthVariableInfo.Attributes & > EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) =3D=3D 0) { > Status =3D DeleteCertsFromDb( > VariableName, > &AuthVarGuid, > -- > 1.9.5.msysgit.1 >=20 > _______________________________________________ > edk2-devel mailing list > edk2-devel@lists.01.org > https://lists.01.org/mailman/listinfo/edk2-devel