tyler.durden/audk
1
0
Fork 0
mirror of https://github.com/acidanthera/audk.git synced 2025-07-29 16:44:10 +02:00
Code Issues Packages Projects Releases Wiki Activity

SecurityPkg: Allow VariablePolicy state to delete authenticated variables

Browse Source 
https://bugzilla.tianocore.org/show_bug.cgi?id=2522

Causes AuthService to check
IsVariablePolicyEnabled() before enforcing
write protections to allow variable deletion
when policy engine is disabled.

Only allows deletion, not modification.

Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Jian J Wang <jian.j.wang@intel.com>
Cc: Chao Zhang <chao.b.zhang@intel.com>
Cc: Bret Barkelew <brbarkel@microsoft.com>
Signed-off-by: Bret Barkelew <brbarkel@microsoft.com>
Reviewed-by: Dandan Bi <dandan.bi@intel.com>
Acked-by: Jian J Wang <jian.j.wang@intel.com>
This commit is contained in:
Bret Barkelew 2020-11-09 14:45:20 +08:00 committed by mergify[bot]
parent e176bafc9d
commit 28f4616fde
2 changed files with 26 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

30
SecurityPkg/Library/AuthVariableLib/AuthService.c
View File

@ -19,12 +19,16 @@
to verify the signature. to verify the signature.
Copyright (c) 2009 - 2019, Intel Corporation. All rights reserved.<BR> Copyright (c) 2009 - 2019, Intel Corporation. All rights reserved.<BR>
Copyright (c) Microsoft Corporation.
SPDX-License-Identifier: BSD-2-Clause-Patent SPDX-License-Identifier: BSD-2-Clause-Patent
**/ **/
#include "AuthServiceInternal.h" #include "AuthServiceInternal.h"
#include <Protocol/VariablePolicy.h>
#include <Library/VariablePolicyLib.h>
// //
// Public Exponent of RSA Key. // Public Exponent of RSA Key.
// //
@ -217,9 +221,12 @@ NeedPhysicallyPresent(
IN EFI_GUID *VendorGuid IN EFI_GUID *VendorGuid
) )
{ {
if ((CompareGuid (VendorGuid, &gEfiSecureBootEnableDisableGuid) && (StrCmp (VariableName, EFI_SECURE_BOOT_ENABLE_NAME) == 0)) // If the VariablePolicy engine is disabled, allow deletion of any authenticated variables.
|| (CompareGuid (VendorGuid, &gEfiCustomModeEnableGuid) && (StrCmp (VariableName, EFI_CUSTOM_MODE_NAME) == 0))) { if (IsVariablePolicyEnabled()) {
return TRUE; if ((CompareGuid (VendorGuid, &gEfiSecureBootEnableDisableGuid) && (StrCmp (VariableName, EFI_SECURE_BOOT_ENABLE_NAME) == 0))
|| (CompareGuid (VendorGuid, &gEfiCustomModeEnableGuid) && (StrCmp (VariableName, EFI_CUSTOM_MODE_NAME) == 0))) {
return TRUE;
}
} }
return FALSE; return FALSE;
@ -842,7 +849,8 @@ ProcessVariable (
&OrgVariableInfo &OrgVariableInfo
); );
if ((!EFI_ERROR (Status)) && IsDeleteAuthVariable (OrgVariableInfo.Attributes, Data, DataSize, Attributes) && UserPhysicalPresent()) { // If the VariablePolicy engine is disabled, allow deletion of any authenticated variables.
if ((!EFI_ERROR (Status)) && IsDeleteAuthVariable (OrgVariableInfo.Attributes, Data, DataSize, Attributes) && (UserPhysicalPresent() || !IsVariablePolicyEnabled())) {
// //
// Allow the delete operation of common authenticated variable(AT or AW) at user physical presence. // Allow the delete operation of common authenticated variable(AT or AW) at user physical presence.
// //
@ -1920,6 +1928,12 @@ VerifyTimeBasedPayload (
PayloadPtr = SigData + SigDataSize; PayloadPtr = SigData + SigDataSize;
PayloadSize = DataSize - OFFSET_OF_AUTHINFO2_CERT_DATA - (UINTN) SigDataSize; PayloadSize = DataSize - OFFSET_OF_AUTHINFO2_CERT_DATA - (UINTN) SigDataSize;
// If the VariablePolicy engine is disabled, allow deletion of any authenticated variables.
if (PayloadSize == 0 && (Attributes & EFI_VARIABLE_APPEND_WRITE) == 0 && !IsVariablePolicyEnabled()) {
VerifyStatus = TRUE;
goto Exit;
}
// //
// Construct a serialization buffer of the values of the VariableName, VendorGuid and Attributes // Construct a serialization buffer of the values of the VariableName, VendorGuid and Attributes
// parameters of the SetVariable() call and the TimeStamp component of the // parameters of the SetVariable() call and the TimeStamp component of the
@ -2173,8 +2187,12 @@ VerifyTimeBasedPayload (
Exit: Exit:
if (AuthVarType == AuthVarTypePk || AuthVarType == AuthVarTypePriv) { if (AuthVarType == AuthVarTypePk || AuthVarType == AuthVarTypePriv) {
Pkcs7FreeSigners (TopLevelCert); if (TopLevelCert != NULL) {
Pkcs7FreeSigners (SignerCerts); Pkcs7FreeSigners (TopLevelCert);
}
if (SignerCerts != NULL) {
Pkcs7FreeSigners (SignerCerts);
}
} }
if (!VerifyStatus) { if (!VerifyStatus) {

2
SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf
View File

@ -3,6 +3,7 @@
# #
# Copyright (c) 2015 - 2016, Intel Corporation. All rights reserved.<BR> # Copyright (c) 2015 - 2016, Intel Corporation. All rights reserved.<BR>
# Copyright (c) 2018, ARM Limited. All rights reserved.<BR> # Copyright (c) 2018, ARM Limited. All rights reserved.<BR>
# Copyright (c) Microsoft Corporation.
# #
# SPDX-License-Identifier: BSD-2-Clause-Patent # SPDX-License-Identifier: BSD-2-Clause-Patent
# #
@ -41,6 +42,7 @@
MemoryAllocationLib MemoryAllocationLib
BaseCryptLib BaseCryptLib
PlatformSecureLib PlatformSecureLib
VariablePolicyLib
[Guids] [Guids]
## CONSUMES ## Variable:L"SetupMode" ## CONSUMES ## Variable:L"SetupMode"