[edk2-devel] [PATCH v1 0/9] Add the VariablePolicy feature

Yao, Jiewen jiewen.yao at intel.com
Sat Apr 11 02:24:41 UTC 2020 

Hi Michael
Thanks for the work.

I remember the feedback before that I have concern on having an API to *DisableVariablePolicy*, and I prefer we have a way to disable the *DisableVariablePolicy*.

May I know how that is addressed in this patch?

Thank you
Yao Jiewen




> -----Original Message-----
> From: michael.kubacki at outlook.com <michael.kubacki at outlook.com>
> Sent: Saturday, April 11, 2020 2:36 AM
> To: devel at edk2.groups.io
> Cc: Yao, Jiewen <jiewen.yao at intel.com>; Zhang, Chao B
> <chao.b.zhang at intel.com>; Wang, Jian J <jian.j.wang at intel.com>; Wu, Hao A
> <hao.a.wu at intel.com>; Gao, Liming <liming.gao at intel.com>
> Subject: [PATCH v1 0/9] Add the VariablePolicy feature
> 
> From: Michael Kubacki <michael.kubacki at microsoft.com>
> 
> REF:https://bugzilla.tianocore.org/show_bug.cgi?id=2522
> 
> The 9 patches in this series add the VariablePolicy feature to the core,
> deprecate Edk2VarLock (while adding a compatibility layer to reduce code
> churn), and integrate the VariablePolicy libraries and protocols into
> Variable Services.
> 
> Since the integration requires multiple changes, including adding libraries,
> a protocol, an SMI communication handler, and VariableServices integration,
> the patches are broken up by individual library additions and then a final
> integration. Security-sensitive changes like bypassing Authenticated
> Variable enforcement are also broken out into individual patches so that
> attention can be called directly to them.
> 
> The discussion of the feature can be found in multiple places throughout
> the last year on the RFC channel, staging branches, and in devel.
> 
> Most recently, this subject was discussed in this thread:
> https://edk2.groups.io/g/devel/message/53712
> (the code branches shared in that discussion are now out of date, but the
> whitepapers and discussion are relevant).
> 
> On a separate note, shallow threading might not work on this patch series
> due to changes made by the SMTP server. Please bear with me while I am
> investigating if this can be changed.
> 
> Cc: Jiewen Yao <jiewen.yao at intel.com>
> Cc: Chao Zhang <chao.b.zhang at intel.com>
> Cc: Jian J Wang <jian.j.wang at intel.com>
> Cc: Hao A Wu <hao.a.wu at intel.com>
> Cc: Liming Gao <liming.gao at intel.com>
> Signed-off-by: Bret Barkelew <brbarkel at microsoft.com>
> Signed-off-by: Michael Kubacki <michael.kubacki at microsoft.com>
> 
> Bret Barkelew (9):
>   MdeModulePkg: Define the VariablePolicy protocol interface
>   MdeModulePkg: Define the VariablePolicyLib
>   MdeModulePkg: Define the VariablePolicyHelperLib
>   MdeModulePkg: Define the VarCheckPolicyLib and SMM interface
>   MdeModulePkg: Connect VariablePolicy business logic to
>     VariableServices
>   MdeModulePkg: Allow VariablePolicy state to delete protected variables
>   SecurityPkg: Allow VariablePolicy state to delete authenticated
>     variables
>   MdeModulePkg: Change TCG MOR variables to use VariablePolicy
>   MdeModulePkg: Drop VarLock from RuntimeDxe variable driver
> 
>  MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.c
> |  211 ++
>  MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.c
> |  396 ++++
>  MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.c                               |
> 773 +++++++
> 
> MdeModulePkg/Library/VariablePolicyLib/VariablePolicyUnitTest/VariablePolicy
> UnitTest.c   | 2285 ++++++++++++++++++++
>  MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockDxe.c
> |   52 +-
>  MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockSmm.c
> |   60 +-
>  MdeModulePkg/Universal/Variable/RuntimeDxe/VarCheck.c
> |   49 +-
>  MdeModulePkg/Universal/Variable/RuntimeDxe/VariableDxe.c
> |   51 +
>  MdeModulePkg/Universal/Variable/RuntimeDxe/VariableLockRequstToLock.c
> |   71 +
>  MdeModulePkg/Universal/Variable/RuntimeDxe/VariablePolicySmmDxe.c
> |  445 ++++
>  MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDxe.c
> |   15 +
>  SecurityPkg/Library/AuthVariableLib/AuthService.c                                        |   22
> +-
>  MdeModulePkg/Include/Guid/VarCheckPolicyMmi.h                                            |
> 43 +
>  MdeModulePkg/Include/Library/VariablePolicyHelperLib.h                                   |
> 164 ++
>  MdeModulePkg/Include/Library/VariablePolicyLib.h                                         |  206
> ++
>  MdeModulePkg/Include/Protocol/VariablePolicy.h                                           |  156
> ++
>  MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.inf
> |   44 +
>  MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.uni
> |   12 +
>  MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.inf
> |   36 +
>  MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.uni
> |   12 +
>  MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.inf                             |
> 38 +
>  MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.uni
> |   12 +
> 
> MdeModulePkg/Library/VariablePolicyLib/VariablePolicyUnitTest/VariablePolicy
> UnitTest.inf |   41 +
>  MdeModulePkg/MdeModulePkg.dec                                                            |   17 +-
>  MdeModulePkg/MdeModulePkg.dsc                                                            |    7 +
>  MdeModulePkg/Test/MdeModulePkgHostTest.dsc                                               |
> 8 +
>  MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf
> |    5 +
>  MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmm.inf
> |    4 +
>  MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDxe.inf
> |    8 +
>  MdeModulePkg/Universal/Variable/RuntimeDxe/VariableStandaloneMm.inf
> |    4 +
>  SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf                                  |    2
> +
>  31 files changed, 5172 insertions(+), 77 deletions(-)
>  create mode 100644
> MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.c
>  create mode 100644
> MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.c
>  create mode 100644
> MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.c
>  create mode 100644
> MdeModulePkg/Library/VariablePolicyLib/VariablePolicyUnitTest/VariablePolicy
> UnitTest.c
>  create mode 100644
> MdeModulePkg/Universal/Variable/RuntimeDxe/VariableLockRequstToLock.c
>  create mode 100644
> MdeModulePkg/Universal/Variable/RuntimeDxe/VariablePolicySmmDxe.c
>  create mode 100644 MdeModulePkg/Include/Guid/VarCheckPolicyMmi.h
>  create mode 100644 MdeModulePkg/Include/Library/VariablePolicyHelperLib.h
>  create mode 100644 MdeModulePkg/Include/Library/VariablePolicyLib.h
>  create mode 100644 MdeModulePkg/Include/Protocol/VariablePolicy.h
>  create mode 100644
> MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.inf
>  create mode 100644
> MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.uni
>  create mode 100644
> MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.inf
>  create mode 100644
> MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.uni
>  create mode 100644
> MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.inf
>  create mode 100644
> MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.uni
>  create mode 100644
> MdeModulePkg/Library/VariablePolicyLib/VariablePolicyUnitTest/VariablePolicy
> UnitTest.inf
> 
> --
> 2.16.3.windows.1


-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.

View/Reply Online (#57253): https://edk2.groups.io/g/devel/message/57253
Mute This Topic: https://groups.io/mt/72928256/1813853
Group Owner: devel+owner at edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub  [edk2-devel-archive at redhat.com]
-=-=-=-=-=-=-=-=-=-=-=-

More information about the edk2-devel-archive mailing list