tyler.durden
/
audk
mirror of https://github.com/acidanthera/audk.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

SecurityPkg: AuthVariableLib: Revert UserPhysicalPresent feature from AuthVariableLib 

Physical Presence state reporting is constrained by physical presence caching in variable driver. For example, reporting must be prior to Physical Presence caching. Physical Presence state becomes constant rather than instant after caching. Therefore, PlatformSecureLib is responsible for reporting Physical Presence state in expected way.

This reverts commit 90fa53213e.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Chao Zhang <chao.b.zhang@intel.com>
Reviewed-by: Yao Jiewen <jiewen.yao@intel.com>
This commit is contained in:
Zhang, Chao B 2016-07-21 14:59:54 +08:00
parent f49513f666
commit 76bfc7e3ea
3 changed files with 4 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
SecurityPkg/Library/AuthVariableLib/AuthService.c
View File

@ -931,7 +931,7 @@ ProcessVarWithPk (
// Init state of Del. State may change due to secure check
//
Del = FALSE;
if ((InCustomMode() && mUserPhysicalPresent) || (mPlatformMode == SETUP_MODE && !IsPk)) {
if ((InCustomMode() && UserPhysicalPresent()) || (mPlatformMode == SETUP_MODE && !IsPk)) {
Payload = (UINT8 *) Data + AUTHINFO2_SIZE (Data);
PayloadSize = DataSize - AUTHINFO2_SIZE (Data);
if (PayloadSize == 0) {
@ -1049,7 +1049,7 @@ ProcessVarWithKek (
}
Status = EFI_SUCCESS;
if (mPlatformMode == USER_MODE && !(InCustomMode() && mUserPhysicalPresent)) {
if (mPlatformMode == USER_MODE && !(InCustomMode() && UserPhysicalPresent())) {
//
// Time-based, verify against X509 Cert KEK.
//
@ -1204,7 +1204,7 @@ ProcessVariable (
&OrgVariableInfo
);
if ((!EFI_ERROR (Status)) && IsDeleteAuthVariable (OrgVariableInfo.Attributes, Data, DataSize, Attributes) && mUserPhysicalPresent) {
if ((!EFI_ERROR (Status)) && IsDeleteAuthVariable (OrgVariableInfo.Attributes, Data, DataSize, Attributes) && UserPhysicalPresent()) {
//
// Allow the delete operation of common authenticated variable at user physical presence.
//
@ -1222,7 +1222,7 @@ ProcessVariable (
return Status;
}
if (NeedPhysicallyPresent (VariableName, VendorGuid) && !mUserPhysicalPresent) {
if (NeedPhysicallyPresent (VariableName, VendorGuid) && !UserPhysicalPresent()) {
//
// This variable is protected, only physical present user could modify its value.
//

1
SecurityPkg/Library/AuthVariableLib/AuthServiceInternal.h
View File

@ -128,7 +128,6 @@ extern UINT8 *mCertDbStore;
extern UINT32 mMaxCertDbSize;
extern UINT32 mPlatformMode;
extern UINT8 mVendorKeyState;
extern BOOLEAN mUserPhysicalPresent;
extern VOID *mHashCtx;

7
SecurityPkg/Library/AuthVariableLib/AuthVariableLib.c
View File

@ -35,7 +35,6 @@ UINT8 *mCertDbStore;
UINT32 mMaxCertDbSize;
UINT32 mPlatformMode;
UINT8 mVendorKeyState;
BOOLEAN mUserPhysicalPresent;
EFI_GUID mSignatureSupport[] = {EFI_CERT_SHA1_GUID, EFI_CERT_SHA256_GUID, EFI_CERT_RSA2048_GUID, EFI_CERT_X509_GUID};
@ -436,12 +435,6 @@ AuthVariableLibInitialize (
AuthVarLibContextOut->AddressPointer = mAuthVarAddressPointer;
AuthVarLibContextOut->AddressPointerCount = sizeof (mAuthVarAddressPointer) / sizeof (mAuthVarAddressPointer[0]);
//
// Cache UserPhysicalPresent State.
// Platform should report PhysicalPresent before this point
//
mUserPhysicalPresent = UserPhysicalPresent();
return Status;
}