[edk2-devel] [PATCH 1/1] SecurityPkg/DxeImageVerificationLib: Set Action for failed unsigned image
Samer El-Haj-Mahmoud
samer.el-haj-mahmoud at arm.com
Tue Oct 26 21:08:35 UTC 2021
Hi Jiewen, Jian, and Min,
Can you please review this patch? We have a corresponding UEFI Spec "code first" ECR (https://bugzilla.tianocore.org/show_bug.cgi?id=3561), and need to clarify a couple of cases in the code.
Thanks,
--Samer
> -----Original Message-----
> From: devel at edk2.groups.io <devel at edk2.groups.io> On Behalf Of Joseph
> Hemann via groups.io
> Sent: Tuesday, October 12, 2021 12:57 PM
> To: devel at edk2.groups.io
> Cc: nd <nd at arm.com>; Joseph Hemann <Joseph.Hemann at arm.com>; Jiewen
> Yao <jiewen.yao at intel.com>; Jian J Wang <jian.j.wang at intel.com>; Min Xu
> <min.m.xu at intel.com>; Joseph Hemann <Joseph.Hemann at arm.com>
> Subject: [edk2-devel] [PATCH 1/1] SecurityPkg/DxeImageVerificationLib: Set
> Action for failed unsigned image
>
> If the image is not signed and the hash of image is not found
> in DB/DBX, then the EFI_IMAGE_INFO_ACTION of the load of said
> image should be set to,
> EFI_IMAGE_EXECUTION_AUTH_SIG_NOT_FOUND, rather then being left
> unset as EFI_IMAGE_EXECUTION_AUTH_UNTESTED.
>
> Cc: Jiewen Yao <jiewen.yao at intel.com>
> Cc: Jian J Wang <jian.j.wang at intel.com>
> Cc: Min Xu <min.m.xu at intel.com>
>
> Signed-off-by: Joseph Hemann <Joseph.Hemann at arm.com>
> Change-Id: Ia432ebf4ec811e36d67b80bc438a6aff60bc9b67
> ---
> .../Library/DxeImageVerificationLib/DxeImageVerificationLib.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git
> a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
> b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
> index 0a804af2162f..e5fae732bb1f 100644
> --- a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
> +++ b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
> @@ -1848,6 +1848,7 @@ DxeImageVerificationHandler (
> //
> // Image Hash is not found in both forbidden and allowed database.
> //
> + Action = EFI_IMAGE_EXECUTION_AUTH_SIG_NOT_FOUND;
> DEBUG ((DEBUG_INFO, "DxeImageVerificationLib: Image is not signed and %s
> hash of image is not found in DB/DBX.\n", mHashTypeStr));
> goto Failed;
> }
> --
> 2.17.1
>
>
>
>
>
-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#82726): https://edk2.groups.io/g/devel/message/82726
Mute This Topic: https://groups.io/mt/86267110/1813853
Group Owner: devel+owner at edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [edk2-devel-archive at redhat.com]
-=-=-=-=-=-=-=-=-=-=-=-
More information about the edk2-devel-archive
mailing list