tyler.durden/audk
1
0
Fork 0
mirror of https://github.com/acidanthera/audk.git synced 2025-07-29 16:44:10 +02:00
Code Issues Packages Projects Releases Wiki Activity

SecurityPkg: AuthVariableLib: Add new cert database for volatile time based Auth variable

Browse Source 
Add a new cert data base "certdbv" to store signer certs for volatile time based
Auth variable.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Chao Zhang <chao.b.zhang@intel.com>
Reviewed-by: Star Zeng <star.zeng@intel.com>
Reviewed-by: Fu Siyuan <siyuan.fu@intel.com>

git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@19786 6f19259b-4bc3-4df7-8a09-765794883524
This commit is contained in:
Chao Zhang 2016-02-02 01:02:31 +00:00 committed by czhang46
parent 378ea6e416
commit 98c2d96105
5 changed files with 146 additions and 58 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

144
SecurityPkg/Library/AuthVariableLib/AuthService.c
View File

@ -18,7 +18,7 @@
They will do basic validation for authentication data structure, then call crypto library They will do basic validation for authentication data structure, then call crypto library
to verify the signature. to verify the signature.
Copyright (c) 2009 - 2015, Intel Corporation. All rights reserved.<BR> Copyright (c) 2009 - 2016, Intel Corporation. All rights reserved.<BR>
This program and the accompanying materials This program and the accompanying materials
are licensed and made available under the terms and conditions of the BSD License are licensed and made available under the terms and conditions of the BSD License
which accompanies this distribution. The full text of the license may be found at which accompanies this distribution. The full text of the license may be found at
@ -2190,7 +2190,7 @@ ProcessVariable (
IN EFI_GUID *VendorGuid, IN EFI_GUID *VendorGuid,
IN VOID *Data, IN VOID *Data,
IN UINTN DataSize, IN UINTN DataSize,
IN UINT32 Attributes OPTIONAL IN UINT32 Attributes
) )
{ {
EFI_STATUS Status; EFI_STATUS Status;
@ -2231,7 +2231,7 @@ ProcessVariable (
0 0
); );
if (!EFI_ERROR (Status) && ((Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0)) { if (!EFI_ERROR (Status) && ((Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0)) {
Status = DeleteCertsFromDb (VariableName, VendorGuid); Status = DeleteCertsFromDb (VariableName, VendorGuid, Attributes);
} }
return Status; return Status;
@ -2544,9 +2544,9 @@ AuthServiceInternalCompareTimeStamp (
/** /**
Find matching signer's certificates for common authenticated variable Find matching signer's certificates for common authenticated variable
by corresponding VariableName and VendorGuid from "certdb". by corresponding VariableName and VendorGuid from "certdb" or "certdbv".
The data format of "certdb": The data format of "certdb" or "certdbv":
// //
// UINT32 CertDbListSize; // UINT32 CertDbListSize;
// /// AUTH_CERT_DB_DATA Certs1[]; // /// AUTH_CERT_DB_DATA Certs1[];
@ -2557,8 +2557,8 @@ AuthServiceInternalCompareTimeStamp (
@param[in] VariableName Name of authenticated Variable. @param[in] VariableName Name of authenticated Variable.
@param[in] VendorGuid Vendor GUID of authenticated Variable. @param[in] VendorGuid Vendor GUID of authenticated Variable.
@param[in] Data Pointer to variable "certdb". @param[in] Data Pointer to variable "certdb" or "certdbv".
@param[in] DataSize Size of variable "certdb". @param[in] DataSize Size of variable "certdb" or "certdbv".
@param[out] CertOffset Offset of matching CertData, from starting of Data. @param[out] CertOffset Offset of matching CertData, from starting of Data.
@param[out] CertDataSize Length of CertData in bytes. @param[out] CertDataSize Length of CertData in bytes.
@param[out] CertNodeOffset Offset of matching AUTH_CERT_DB_DATA , from @param[out] CertNodeOffset Offset of matching AUTH_CERT_DB_DATA , from
@ -2665,15 +2665,17 @@ FindCertsFromDb (
/** /**
Retrieve signer's certificates for common authenticated variable Retrieve signer's certificates for common authenticated variable
by corresponding VariableName and VendorGuid from "certdb". by corresponding VariableName and VendorGuid from "certdb"
or "certdbv" according to authenticated variable attributes.
@param[in] VariableName Name of authenticated Variable. @param[in] VariableName Name of authenticated Variable.
@param[in] VendorGuid Vendor GUID of authenticated Variable. @param[in] VendorGuid Vendor GUID of authenticated Variable.
@param[in] Attributes Attributes of authenticated variable.
@param[out] CertData Pointer to signer's certificates. @param[out] CertData Pointer to signer's certificates.
@param[out] CertDataSize Length of CertData in bytes. @param[out] CertDataSize Length of CertData in bytes.
@retval EFI_INVALID_PARAMETER Any input parameter is invalid. @retval EFI_INVALID_PARAMETER Any input parameter is invalid.
@retval EFI_NOT_FOUND Fail to find "certdb" or matching certs. @retval EFI_NOT_FOUND Fail to find "certdb"/"certdbv" or matching certs.
@retval EFI_SUCCESS Get signer's certificates successfully. @retval EFI_SUCCESS Get signer's certificates successfully.
**/ **/
@ -2681,6 +2683,7 @@ EFI_STATUS
GetCertsFromDb ( GetCertsFromDb (
IN CHAR16 *VariableName, IN CHAR16 *VariableName,
IN EFI_GUID *VendorGuid, IN EFI_GUID *VendorGuid,
IN UINT32 Attributes,
OUT UINT8 **CertData, OUT UINT8 **CertData,
OUT UINT32 *CertDataSize OUT UINT32 *CertDataSize
) )
@ -2689,16 +2692,30 @@ GetCertsFromDb (
UINT8 *Data; UINT8 *Data;
UINTN DataSize; UINTN DataSize;
UINT32 CertOffset; UINT32 CertOffset;
CHAR16 *DbName;
if ((VariableName == NULL) || (VendorGuid == NULL) || (CertData == NULL) || (CertDataSize == NULL)) { if ((VariableName == NULL) || (VendorGuid == NULL) || (CertData == NULL) || (CertDataSize == NULL)) {
return EFI_INVALID_PARAMETER; return EFI_INVALID_PARAMETER;
} }
if ((Attributes & EFI_VARIABLE_NON_VOLATILE) != 0) {
//
// Get variable "certdb".
//
DbName = EFI_CERT_DB_NAME;
} else {
//
// Get variable "certdbv".
//
DbName = EFI_CERT_DB_VOLATILE_NAME;
}
// //
// Get variable "certdb". // Get variable "certdb" or "certdbv".
// //
Status = AuthServiceInternalFindVariable ( Status = AuthServiceInternalFindVariable (
EFI_CERT_DB_NAME, DbName,
&gEfiCertDbGuid, &gEfiCertDbGuid,
(VOID **) &Data, (VOID **) &Data,
&DataSize &DataSize
@ -2733,13 +2750,15 @@ GetCertsFromDb (
/** /**
Delete matching signer's certificates when deleting common authenticated Delete matching signer's certificates when deleting common authenticated
variable by corresponding VariableName and VendorGuid from "certdb". variable by corresponding VariableName and VendorGuid from "certdb" or
"certdbv" according to authenticated variable attributes.
@param[in] VariableName Name of authenticated Variable. @param[in] VariableName Name of authenticated Variable.
@param[in] VendorGuid Vendor GUID of authenticated Variable. @param[in] VendorGuid Vendor GUID of authenticated Variable.
@param[in] Attributes Attributes of authenticated variable.
@retval EFI_INVALID_PARAMETER Any input parameter is invalid. @retval EFI_INVALID_PARAMETER Any input parameter is invalid.
@retval EFI_NOT_FOUND Fail to find "certdb" or matching certs. @retval EFI_NOT_FOUND Fail to find "certdb"/"certdbv" or matching certs.
@retval EFI_OUT_OF_RESOURCES The operation is failed due to lack of resources. @retval EFI_OUT_OF_RESOURCES The operation is failed due to lack of resources.
@retval EFI_SUCCESS The operation is completed successfully. @retval EFI_SUCCESS The operation is completed successfully.
@ -2747,7 +2766,8 @@ GetCertsFromDb (
EFI_STATUS EFI_STATUS
DeleteCertsFromDb ( DeleteCertsFromDb (
IN CHAR16 *VariableName, IN CHAR16 *VariableName,
IN EFI_GUID *VendorGuid IN EFI_GUID *VendorGuid,
IN UINT32 Attributes
) )
{ {
EFI_STATUS Status; EFI_STATUS Status;
@ -2758,20 +2778,33 @@ DeleteCertsFromDb (
UINT32 CertNodeSize; UINT32 CertNodeSize;
UINT8 *NewCertDb; UINT8 *NewCertDb;
UINT32 NewCertDbSize; UINT32 NewCertDbSize;
CHAR16 *DbName;
if ((VariableName == NULL) || (VendorGuid == NULL)) { if ((VariableName == NULL) || (VendorGuid == NULL)) {
return EFI_INVALID_PARAMETER; return EFI_INVALID_PARAMETER;
} }
// if ((Attributes & EFI_VARIABLE_NON_VOLATILE) != 0) {
// Get variable "certdb". //
// // Get variable "certdb".
//
DbName = EFI_CERT_DB_NAME;
VarAttr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
} else {
//
// Get variable "certdbv".
//
DbName = EFI_CERT_DB_VOLATILE_NAME;
VarAttr = EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
}
Status = AuthServiceInternalFindVariable ( Status = AuthServiceInternalFindVariable (
EFI_CERT_DB_NAME, DbName,
&gEfiCertDbGuid, &gEfiCertDbGuid,
(VOID **) &Data, (VOID **) &Data,
&DataSize &DataSize
); );
if (EFI_ERROR (Status)) { if (EFI_ERROR (Status)) {
return Status; return Status;
} }
@ -2783,13 +2816,13 @@ DeleteCertsFromDb (
if (DataSize == sizeof (UINT32)) { if (DataSize == sizeof (UINT32)) {
// //
// There is no certs in certdb. // There is no certs in "certdb" or "certdbv".
// //
return EFI_SUCCESS; return EFI_SUCCESS;
} }
// //
// Get corresponding cert node from certdb. // Get corresponding cert node from "certdb" or "certdbv".
// //
Status = FindCertsFromDb ( Status = FindCertsFromDb (
VariableName, VariableName,
@ -2811,7 +2844,7 @@ DeleteCertsFromDb (
} }
// //
// Construct new data content of variable "certdb". // Construct new data content of variable "certdb" or "certdbv".
// //
NewCertDbSize = (UINT32) DataSize - CertNodeSize; NewCertDbSize = (UINT32) DataSize - CertNodeSize;
NewCertDb = (UINT8*) mCertDbStore; NewCertDb = (UINT8*) mCertDbStore;
@ -2836,11 +2869,10 @@ DeleteCertsFromDb (
} }
// //
// Set "certdb". // Set "certdb" or "certdbv".
// //
VarAttr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
Status = AuthServiceInternalUpdateVariable ( Status = AuthServiceInternalUpdateVariable (
EFI_CERT_DB_NAME, DbName,
&gEfiCertDbGuid, &gEfiCertDbGuid,
NewCertDb, NewCertDb,
NewCertDbSize, NewCertDbSize,
@ -2852,10 +2884,12 @@ DeleteCertsFromDb (
/** /**
Insert signer's certificates for common authenticated variable with VariableName Insert signer's certificates for common authenticated variable with VariableName
and VendorGuid in AUTH_CERT_DB_DATA to "certdb". and VendorGuid in AUTH_CERT_DB_DATA to "certdb" or "certdbv" according to
time based authenticated variable attributes.
@param[in] VariableName Name of authenticated Variable. @param[in] VariableName Name of authenticated Variable.
@param[in] VendorGuid Vendor GUID of authenticated Variable. @param[in] VendorGuid Vendor GUID of authenticated Variable.
@param[in] Attributes Attributes of authenticated variable.
@param[in] CertData Pointer to signer's certificates. @param[in] CertData Pointer to signer's certificates.
@param[in] CertDataSize Length of CertData in bytes. @param[in] CertDataSize Length of CertData in bytes.
@ -2863,13 +2897,14 @@ DeleteCertsFromDb (
@retval EFI_ACCESS_DENIED An AUTH_CERT_DB_DATA entry with same VariableName @retval EFI_ACCESS_DENIED An AUTH_CERT_DB_DATA entry with same VariableName
and VendorGuid already exists. and VendorGuid already exists.
@retval EFI_OUT_OF_RESOURCES The operation is failed due to lack of resources. @retval EFI_OUT_OF_RESOURCES The operation is failed due to lack of resources.
@retval EFI_SUCCESS Insert an AUTH_CERT_DB_DATA entry to "certdb" @retval EFI_SUCCESS Insert an AUTH_CERT_DB_DATA entry to "certdb" or "certdbv"
**/ **/
EFI_STATUS EFI_STATUS
InsertCertsToDb ( InsertCertsToDb (
IN CHAR16 *VariableName, IN CHAR16 *VariableName,
IN EFI_GUID *VendorGuid, IN EFI_GUID *VendorGuid,
IN UINT32 Attributes,
IN UINT8 *CertData, IN UINT8 *CertData,
IN UINTN CertDataSize IN UINTN CertDataSize
) )
@ -2883,16 +2918,31 @@ InsertCertsToDb (
UINT32 CertNodeSize; UINT32 CertNodeSize;
UINT32 NameSize; UINT32 NameSize;
AUTH_CERT_DB_DATA *Ptr; AUTH_CERT_DB_DATA *Ptr;
CHAR16 *DbName;
if ((VariableName == NULL) || (VendorGuid == NULL) || (CertData == NULL)) { if ((VariableName == NULL) || (VendorGuid == NULL) || (CertData == NULL)) {
return EFI_INVALID_PARAMETER; return EFI_INVALID_PARAMETER;
} }
if ((Attributes & EFI_VARIABLE_NON_VOLATILE) != 0) {
//
// Get variable "certdb".
//
DbName = EFI_CERT_DB_NAME;
VarAttr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
} else {
//
// Get variable "certdbv".
//
DbName = EFI_CERT_DB_VOLATILE_NAME;
VarAttr = EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
}
// //
// Get variable "certdb". // Get variable "certdb" or "certdbv".
// //
Status = AuthServiceInternalFindVariable ( Status = AuthServiceInternalFindVariable (
EFI_CERT_DB_NAME, DbName,
&gEfiCertDbGuid, &gEfiCertDbGuid,
(VOID **) &Data, (VOID **) &Data,
&DataSize &DataSize
@ -2907,7 +2957,7 @@ InsertCertsToDb (
} }
// //
// Find whether matching cert node already exists in "certdb". // Find whether matching cert node already exists in "certdb" or "certdbv".
// If yes return error. // If yes return error.
// //
Status = FindCertsFromDb ( Status = FindCertsFromDb (
@ -2927,7 +2977,7 @@ InsertCertsToDb (
} }
// //
// Construct new data content of variable "certdb". // Construct new data content of variable "certdb" or "certdbv".
// //
NameSize = (UINT32) StrLen (VariableName); NameSize = (UINT32) StrLen (VariableName);
CertNodeSize = sizeof (AUTH_CERT_DB_DATA) + (UINT32) CertDataSize + NameSize * sizeof (CHAR16); CertNodeSize = sizeof (AUTH_CERT_DB_DATA) + (UINT32) CertDataSize + NameSize * sizeof (CHAR16);
@ -2967,11 +3017,10 @@ InsertCertsToDb (
); );
// //
// Set "certdb". // Set "certdb" or "certdbv".
// //
VarAttr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
Status = AuthServiceInternalUpdateVariable ( Status = AuthServiceInternalUpdateVariable (
EFI_CERT_DB_NAME, DbName,
&gEfiCertDbGuid, &gEfiCertDbGuid,
NewCertDb, NewCertDb,
NewCertDbSize, NewCertDbSize,
@ -3007,9 +3056,8 @@ CleanCertsFromDb (
BOOLEAN CertCleaned; BOOLEAN CertCleaned;
UINT8 *Data; UINT8 *Data;
UINTN DataSize; UINTN DataSize;
UINT8 *AuthVarData;
UINTN AuthVarDataSize;
EFI_GUID AuthVarGuid; EFI_GUID AuthVarGuid;
AUTH_VARIABLE_INFO AuthVariableInfo;
Status = EFI_SUCCESS; Status = EFI_SUCCESS;
@ -3060,15 +3108,19 @@ CleanCertsFromDb (
// //
// Find corresponding time auth variable // Find corresponding time auth variable
// //
Status = AuthServiceInternalFindVariable ( ZeroMem (&AuthVariableInfo, sizeof (AuthVariableInfo));
VariableName, Status = mAuthVarLibContextIn->FindVariable (
&AuthVarGuid, VariableName,
(VOID **) &AuthVarData, &AuthVarGuid,
&AuthVarDataSize &AuthVariableInfo
); );
if (EFI_ERROR(Status)) { if (EFI_ERROR(Status)) {
Status = DeleteCertsFromDb(VariableName, &AuthVarGuid); Status = DeleteCertsFromDb(
VariableName,
&AuthVarGuid,
AuthVariableInfo.Attributes
);
CertCleaned = TRUE; CertCleaned = TRUE;
DEBUG((EFI_D_INFO, "Recovery!! Cert for Auth Variable %s Guid %g is removed for consistency\n", VariableName, &AuthVarGuid)); DEBUG((EFI_D_INFO, "Recovery!! Cert for Auth Variable %s Guid %g is removed for consistency\n", VariableName, &AuthVarGuid));
FreePool(VariableName); FreePool(VariableName);
@ -3374,14 +3426,14 @@ VerifyTimeBasedPayload (
} }
// //
// Get previously stored signer's certificates from certdb for existing // Get previously stored signer's certificates from certdb or certdbv for existing
// variable. Check whether they are identical with signer's certificates // variable. Check whether they are identical with signer's certificates
// in SignedData. If not, return error immediately. // in SignedData. If not, return error immediately.
// //
if (OrgTimeStamp != NULL) { if (OrgTimeStamp != NULL) {
VerifyStatus = FALSE; VerifyStatus = FALSE;
Status = GetCertsFromDb (VariableName, VendorGuid, &CertsInCertDb, &CertsSizeinDb); Status = GetCertsFromDb (VariableName, VendorGuid, Attributes, &CertsInCertDb, &CertsSizeinDb);
if (EFI_ERROR (Status)) { if (EFI_ERROR (Status)) {
goto Exit; goto Exit;
} }
@ -3408,7 +3460,7 @@ VerifyTimeBasedPayload (
// //
// Insert signer's certificates when adding a new common authenticated variable. // Insert signer's certificates when adding a new common authenticated variable.
// //
Status = InsertCertsToDb (VariableName, VendorGuid, SignerCerts, CertStackSize); Status = InsertCertsToDb (VariableName, VendorGuid, Attributes, SignerCerts, CertStackSize);
if (EFI_ERROR (Status)) { if (EFI_ERROR (Status)) {
VerifyStatus = FALSE; VerifyStatus = FALSE;
goto Exit; goto Exit;
@ -3549,7 +3601,7 @@ VerifyTimeBasedPayloadAndUpdate (
// Delete signer's certificates when delete the common authenticated variable. // Delete signer's certificates when delete the common authenticated variable.
// //
if (IsDel && AuthVarType == AuthVarTypePriv && !EFI_ERROR(Status) ) { if (IsDel && AuthVarType == AuthVarTypePriv && !EFI_ERROR(Status) ) {
Status = DeleteCertsFromDb (VariableName, VendorGuid); Status = DeleteCertsFromDb (VariableName, VendorGuid, Attributes);
} }
if (VarDel != NULL) { if (VarDel != NULL) {

22
SecurityPkg/Library/AuthVariableLib/AuthServiceInternal.h
View File

@ -12,7 +12,7 @@
may not be modified without authorization. If platform fails to protect these resources, may not be modified without authorization. If platform fails to protect these resources,
the authentication service provided in this driver will be broken, and the behavior is undefined. the authentication service provided in this driver will be broken, and the behavior is undefined.
Copyright (c) 2009 - 2015, Intel Corporation. All rights reserved.<BR> Copyright (c) 2009 - 2016, Intel Corporation. All rights reserved.<BR>
This program and the accompanying materials This program and the accompanying materials
are licensed and made available under the terms and conditions of the BSD License are licensed and made available under the terms and conditions of the BSD License
which accompanies this distribution. The full text of the license may be found at which accompanies this distribution. The full text of the license may be found at
@ -86,8 +86,10 @@ typedef struct {
#pragma pack() #pragma pack()
/// ///
/// "certdb" variable stores the signer's certificates for non PK/KEK/DB/DBX /// "certdb" variable stores the signer's certificates for non PK/KEK/DB/DBX
/// variables with EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set. /// variables with EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS|EFI_VARIABLE_NON_VOLATILE set.
/// "certdbv" variable stores the signer's certificates for non PK/KEK/DB/DBX
/// variables with EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set
/// ///
/// GUID: gEfiCertDbGuid /// GUID: gEfiCertDbGuid
/// ///
@ -104,7 +106,8 @@ typedef struct {
/// | AUTH_CERT_DB_DATA | <-- Last CERT /// | AUTH_CERT_DB_DATA | <-- Last CERT
/// +----------------------------+ /// +----------------------------+
/// ///
#define EFI_CERT_DB_NAME L"certdb" #define EFI_CERT_DB_NAME L"certdb"
#define EFI_CERT_DB_VOLATILE_NAME L"certdbv"
#pragma pack(1) #pragma pack(1)
typedef struct { typedef struct {
@ -229,13 +232,15 @@ VerifyTimeBasedPayloadAndUpdate (
/** /**
Delete matching signer's certificates when deleting common authenticated Delete matching signer's certificates when deleting common authenticated
variable by corresponding VariableName and VendorGuid from "certdb". variable by corresponding VariableName and VendorGuid from "certdb" or
"certdbv" according to authenticated variable attributes.
@param[in] VariableName Name of authenticated Variable. @param[in] VariableName Name of authenticated Variable.
@param[in] VendorGuid Vendor GUID of authenticated Variable. @param[in] VendorGuid Vendor GUID of authenticated Variable.
@param[in] Attributes Attributes of authenticated variable.
@retval EFI_INVALID_PARAMETER Any input parameter is invalid. @retval EFI_INVALID_PARAMETER Any input parameter is invalid.
@retval EFI_NOT_FOUND Fail to find "certdb" or matching certs. @retval EFI_NOT_FOUND Fail to find "certdb"/"certdbv" or matching certs.
@retval EFI_OUT_OF_RESOURCES The operation is failed due to lack of resources. @retval EFI_OUT_OF_RESOURCES The operation is failed due to lack of resources.
@retval EFI_SUCCESS The operation is completed successfully. @retval EFI_SUCCESS The operation is completed successfully.
@ -243,7 +248,8 @@ VerifyTimeBasedPayloadAndUpdate (
EFI_STATUS EFI_STATUS
DeleteCertsFromDb ( DeleteCertsFromDb (
IN CHAR16 *VariableName, IN CHAR16 *VariableName,
IN EFI_GUID *VendorGuid IN EFI_GUID *VendorGuid,
IN UINT32 Attributes
); );
/** /**
@ -410,7 +416,7 @@ ProcessVariable (
IN EFI_GUID *VendorGuid, IN EFI_GUID *VendorGuid,
IN VOID *Data, IN VOID *Data,
IN UINTN DataSize, IN UINTN DataSize,
IN UINT32 Attributes OPTIONAL IN UINT32 Attributes
); );
/** /**

32
SecurityPkg/Library/AuthVariableLib/AuthVariableLib.c
View File

@ -11,7 +11,7 @@
may not be modified without authorization. If platform fails to protect these resources, may not be modified without authorization. If platform fails to protect these resources,
the authentication service provided in this driver will be broken, and the behavior is undefined. the authentication service provided in this driver will be broken, and the behavior is undefined.
Copyright (c) 2015, Intel Corporation. All rights reserved.<BR> Copyright (c) 2015 - 2016, Intel Corporation. All rights reserved.<BR>
This program and the accompanying materials This program and the accompanying materials
are licensed and made available under the terms and conditions of the BSD License are licensed and made available under the terms and conditions of the BSD License
which accompanies this distribution. The full text of the license may be found at which accompanies this distribution. The full text of the license may be found at
@ -98,6 +98,17 @@ VARIABLE_ENTRY_PROPERTY mAuthVarEntry[] = {
MAX_UINTN MAX_UINTN
} }
}, },
{
&gEfiCertDbGuid,
EFI_CERT_DB_VOLATILE_NAME,
{
VAR_CHECK_VARIABLE_PROPERTY_REVISION,
VAR_CHECK_VARIABLE_PROPERTY_READ_ONLY,
VARIABLE_ATTRIBUTE_BS_RT_AT,
sizeof (UINT32),
MAX_UINTN
}
},
{ {
&gEdkiiSecureBootModeGuid, &gEdkiiSecureBootModeGuid,
L"SecureBootMode", L"SecureBootMode",
@ -172,8 +183,9 @@ AuthVariableLibInitialize (
// //
// Reserve runtime buffer for certificate database. The size excludes variable header and name size. // Reserve runtime buffer for certificate database. The size excludes variable header and name size.
// Use EFI_CERT_DB_VOLATILE_NAME size since it is longer.
// //
mMaxCertDbSize = (UINT32) (mAuthVarLibContextIn->MaxAuthVariableSize - sizeof (EFI_CERT_DB_NAME)); mMaxCertDbSize = (UINT32) (mAuthVarLibContextIn->MaxAuthVariableSize - sizeof (EFI_CERT_DB_VOLATILE_NAME));
mCertDbStore = AllocateRuntimePool (mMaxCertDbSize); mCertDbStore = AllocateRuntimePool (mMaxCertDbSize);
if (mCertDbStore == NULL) { if (mCertDbStore == NULL) {
return EFI_OUT_OF_RESOURCES; return EFI_OUT_OF_RESOURCES;
@ -288,6 +300,22 @@ AuthVariableLibInitialize (
} }
} }
//
// Create "certdbv" variable with RT+BS+AT set.
//
VarAttr = EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
ListSize = sizeof (UINT32);
Status = AuthServiceInternalUpdateVariable (
EFI_CERT_DB_VOLATILE_NAME,
&gEfiCertDbGuid,
&ListSize,
sizeof (UINT32),
VarAttr
);
if (EFI_ERROR (Status)) {
return Status;
}
// //
// Check "VendorKeysNv" variable's existence and create "VendorKeys" variable accordingly. // Check "VendorKeysNv" variable's existence and create "VendorKeys" variable accordingly.
// //

4
SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf
View File

@ -1,7 +1,7 @@
## @file ## @file
# Provides authenticated variable services. # Provides authenticated variable services.
# #
# Copyright (c) 2015, Intel Corporation. All rights reserved.<BR> # Copyright (c) 2015 - 2016, Intel Corporation. All rights reserved.<BR>
# #
# This program and the accompanying materials # This program and the accompanying materials
# are licensed and made available under the terms and conditions # are licensed and made available under the terms and conditions
@ -74,7 +74,9 @@
gEfiCustomModeEnableGuid gEfiCustomModeEnableGuid
## CONSUMES ## Variable:L"certdb" ## CONSUMES ## Variable:L"certdb"
## CONSUMES ## Variable:L"certdbv"
## PRODUCES ## Variable:L"certdb" ## PRODUCES ## Variable:L"certdb"
## PRODUCES ## Variable:L"certdbv"
gEfiCertDbGuid gEfiCertDbGuid
## CONSUMES ## Variable:L"VendorKeysNv" ## CONSUMES ## Variable:L"VendorKeysNv"

2
SecurityPkg/SecurityPkg.dec
View File

@ -106,7 +106,7 @@
# Include/Guid/AuthenticatedVariableFormat.h # Include/Guid/AuthenticatedVariableFormat.h
gEfiVendorKeysNvGuid = { 0x9073e4e0, 0x60ec, 0x4b6e, { 0x99, 0x3, 0x4c, 0x22, 0x3c, 0x26, 0xf, 0x3c } } gEfiVendorKeysNvGuid = { 0x9073e4e0, 0x60ec, 0x4b6e, { 0x99, 0x3, 0x4c, 0x22, 0x3c, 0x26, 0xf, 0x3c } }
## GUID used to "certdb" variable to store the signer's certificates for common variables with EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS attribute. ## GUID used to "certdb"/"certdbv" variable to store the signer's certificates for common variables with EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS attribute.
# Include/Guid/AuthenticatedVariableFormat.h # Include/Guid/AuthenticatedVariableFormat.h
gEfiCertDbGuid = { 0xd9bee56e, 0x75dc, 0x49d9, { 0xb4, 0xd7, 0xb5, 0x34, 0x21, 0xf, 0x63, 0x7a } } gEfiCertDbGuid = { 0xd9bee56e, 0x75dc, 0x49d9, { 0xb4, 0xd7, 0xb5, 0x34, 0x21, 0xf, 0x63, 0x7a } }