1. Change default PCD in SecurityPkg to 4 (DENY_EXECUTE) in DEC file.

[mirror_edk2.git] / OvmfPkg / OvmfPkgIa32X64.dsc

diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
index 6373ecfebeae30ec9e542f815bd81dffc914eba4..2c7b4573327ad56a62118a3911c46b878c79d570 100644 (file)
--- a/OvmfPkg/OvmfPkgIa32X64.dsc
+++ b/OvmfPkg/OvmfPkgIa32X64.dsc
@@ -309,9 +309,9 @@
 [PcdsFixedAtBuild.X64]\r
 !if $(SECURE_BOOT_ENABLE) == TRUE\r
   # override the default values from SecurityPkg to ensure images from all sources are verified in secure boot\r
-  gEfiSecurityPkgTokenSpaceGuid.PcdOptionRomImageVerificationPolicy|0x05\r
-  gEfiSecurityPkgTokenSpaceGuid.PcdFixedMediaImageVerificationPolicy|0x05\r
-  gEfiSecurityPkgTokenSpaceGuid.PcdRemovableMediaImageVerificationPolicy|0x05\r
+  gEfiSecurityPkgTokenSpaceGuid.PcdOptionRomImageVerificationPolicy|0x04\r
+  gEfiSecurityPkgTokenSpaceGuid.PcdFixedMediaImageVerificationPolicy|0x04\r
+  gEfiSecurityPkgTokenSpaceGuid.PcdRemovableMediaImageVerificationPolicy|0x04\r
 !endif\r
 \r
   # IRQs 5, 9, 10, 11 are level-triggered\r