SecurityPkg/Library/DxeImageAuthenticationStatusLib/DxeImageAuthenticationStatusLib.c

   1 /** @file
   2   Implement image authentication status check in UEFI2.3.1.
   3
   4 Copyright (c) 2012 - 2018, Intel Corporation. All rights reserved.<BR>
   5 SPDX-License-Identifier: BSD-2-Clause-Patent
   6
   7 **/
   8
   9 #include <PiDxe.h>
  10 #include <Library/SecurityManagementLib.h>
  11
  12
  13 /**
  14   Check image authentication status returned from Section Extraction Protocol
  15
  16   @param[in]    AuthenticationStatus  This is the authentication status returned from
  17                              the Section Extraction Protocol when reading the input file.
  18   @param[in]    File       This is a pointer to the device path of the file that is
  19                            being dispatched. This will optionally be used for logging.
  20   @param[in]    FileBuffer File buffer matches the input file device path.
  21   @param[in]    FileSize   Size of File buffer matches the input file device path.
  22   @param[in]    BootPolicy A boot policy that was used to call LoadImage() UEFI service.
  23
  24   @retval EFI_SUCCESS            The input file specified by File did authenticate, and the
  25                                  platform policy dictates that the DXE Core may use File.
  26   @retval EFI_ACCESS_DENIED      The file specified by File and FileBuffer did not
  27                                  authenticate, and the platform policy dictates that the DXE
  28                                  Foundation many not use File.
  29
  30 **/
  31 EFI_STATUS
  32 EFIAPI
  33 DxeImageAuthenticationStatusHandler (
  34   IN  UINT32                           AuthenticationStatus,
  35   IN  CONST EFI_DEVICE_PATH_PROTOCOL   *File, OPTIONAL
  36   IN  VOID                             *FileBuffer,
  37   IN  UINTN                            FileSize,
  38   IN  BOOLEAN                          BootPolicy
  39   )
  40 {
  41   if ((AuthenticationStatus & EFI_AUTH_STATUS_IMAGE_SIGNED) != 0) {
  42     if ((AuthenticationStatus & (EFI_AUTH_STATUS_TEST_FAILED | EFI_AUTH_STATUS_NOT_TESTED)) != 0) {
  43       return EFI_ACCESS_DENIED;
  44     }
  45   }
  46
  47   return EFI_SUCCESS;
  48 }
  49
  50
  51 /**
  52   Register image authentication status check handler.
  53
  54   @param  ImageHandle   ImageHandle of the loaded driver.
  55   @param  SystemTable   Pointer to the EFI System Table.
  56
  57   @retval EFI_SUCCESS   The handlers were registered successfully.
  58 **/
  59 EFI_STATUS
  60 EFIAPI
  61 DxeImageAuthenticationStatusLibConstructor (
  62   IN EFI_HANDLE        ImageHandle,
  63   IN EFI_SYSTEM_TABLE  *SystemTable
  64   )
  65 {
  66   return RegisterSecurity2Handler (
  67            DxeImageAuthenticationStatusHandler,
  68            EFI_AUTH_OPERATION_AUTHENTICATION_STATE
  69            );
  70 }