Add PI1.2.1 SAP2 support and UEFI231B mantis 896

1. Update three Security Handlers to depend on new SecurityManagementLib APIs to register Security service for SAP2

Signed-off-by: Liming Gao <liming.gao@intel.com>
Reviewed-by: Guo Dong <dong.guo@intel.com>
git-svn-id: https://edk2.svn.sourceforge.net/svnroot/edk2/trunk/edk2@13661 6f19259b-4bc3-4df7-8a09-765794883524

diff --git a/SecurityPkg/Library/DxeDeferImageLoadLib/DxeDeferImageLoadLib.c b/SecurityPkg/Library/DxeDeferImageLoadLib/DxeDeferImageLoadLib.c
index 84b8cf78847c06143b70d6d07e42d983ac2c7da5..fd18d2f7e7471d1c5cded7281eadaf8ddb28d7bd 100644 (file)
--- a/SecurityPkg/Library/DxeDeferImageLoadLib/DxeDeferImageLoadLib.c
+++ b/SecurityPkg/Library/DxeDeferImageLoadLib/DxeDeferImageLoadLib.c
@@ -714,18 +714,22 @@ GetDefferedImageInfo (
                                     logging.\r
   @param[in]  FileBuffer            File buffer matches the input file device path.\r
   @param[in]  FileSize              Size of File buffer matches the input file device path.\r
-\r
-  @retval EFI_SUCCESS               The file specified by File did authenticate, and the\r
-                                    platform policy dictates that the DXE Core may use File.\r
-  @retval EFI_INVALID_PARAMETER     File is NULL.\r
-  @retval EFI_SECURITY_VIOLATION    The file specified by File did not authenticate, and\r
-                                    the platform policy dictates that File should be placed\r
-                                    in the untrusted state. A file may be promoted from\r
-                                    the untrusted to the trusted state at a future time\r
-                                    with a call to the Trust() DXE Service.\r
-  @retval EFI_ACCESS_DENIED         The file specified by File did not authenticate, and\r
-                                    the platform policy dictates that File should not be\r
-                                    used for any purpose.\r
+  @param[in]  BootPolicy            A boot policy that was used to call LoadImage() UEFI service.\r
+\r
+  @retval EFI_SUCCESS               FileBuffer is NULL and current user has permission to start\r
+                                    UEFI device drivers on the device path specified by DevicePath.\r
+  @retval EFI_SUCCESS               The file specified by DevicePath and non-NULL\r
+                                    FileBuffer did authenticate, and the platform policy dictates\r
+                                    that the DXE Foundation may use the file.\r
+  @retval EFI_SECURITY_VIOLATION    FileBuffer is NULL and the user has no\r
+                                    permission to start UEFI device drivers on the device path specified\r
+                                    by DevicePath.\r
+  @retval EFI_SECURITY_VIOLATION    FileBuffer is not NULL and the user has no permission to load\r
+                                    drivers from the device path specified by DevicePath. The\r
+                                    image has been added into the list of the deferred images.\r
+  @retval EFI_ACCESS_DENIED         The file specified by File and FileBuffer did not\r
+                                    authenticate, and the platform policy dictates that the DXE\r
+                                    Foundation many not use File.\r
 \r
 **/\r
 EFI_STATUS\r
@@ -734,17 +738,20 @@ DxeDeferImageLoadHandler (
   IN  UINT32                           AuthenticationStatus,\r
   IN  CONST EFI_DEVICE_PATH_PROTOCOL   *File,\r
   IN  VOID                             *FileBuffer,\r
-  IN  UINTN                            FileSize\r
+  IN  UINTN                            FileSize,\r
+  IN  BOOLEAN                          BootPolicy\r
   )\r
-\r
 {\r
   EFI_STATUS                           Status;\r
   EFI_USER_PROFILE_HANDLE              CurrentUser;\r
   UINT32                               Policy;\r
   UINT32                               FileType;\r
 \r
+  //\r
+  // Ignore if File is NULL.\r
+  //\r
   if (File == NULL) {\r
-    return EFI_INVALID_PARAMETER;\r
+    return EFI_SUCCESS;\r
   }\r
 \r
   //\r
@@ -759,7 +766,7 @@ DxeDeferImageLoadHandler (
       //\r
       if (!VerifyDevicePath (File)) {\r
         DEBUG ((EFI_D_ERROR, "[Security] The image is forbidden to load!\n"));\r
-        return EFI_ACCESS_DENIED;\r
+        return EFI_SECURITY_VIOLATION;\r
       }\r
       return EFI_SUCCESS;\r
     }\r
@@ -779,7 +786,7 @@ DxeDeferImageLoadHandler (
   }\r
  \r
   DEBUG ((EFI_D_ERROR, "[Security] No user identified, the image is deferred to load!\n"));\r
-  PutDefferedImageInfo (File, NULL, 0);\r
+  PutDefferedImageInfo (File, FileBuffer, FileSize);\r
 \r
   //\r
   // Install the Deferred Image Load Protocol onto a new handle.\r
@@ -849,7 +856,7 @@ DxeDeferImageLoadLibConstructor (
     &Registration\r
     );\r
   \r
-  return RegisterSecurityHandler (\r
+  return RegisterSecurity2Handler (\r
            DxeDeferImageLoadHandler,\r
            EFI_AUTH_OPERATION_DEFER_IMAGE_LOAD \r
            );      \r

diff --git a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
index 402540eb1b2bd4469f42bffcc5b6975537848ea5..c86ce1f312ae5c7543e4ea356863fb9c81b08c64 100644 (file)
--- a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
+++ b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
@@ -141,6 +141,10 @@ GetImageType (
   EFI_DEVICE_PATH_PROTOCOL          *TempDevicePath;\r
   EFI_BLOCK_IO_PROTOCOL             *BlockIo;\r
 \r
+  if (File == NULL) {\r
+    return IMAGE_UNKNOWN;\r
+  }\r
+\r
   //\r
   // First check to see if File is from a Firmware Volume\r
   //\r
@@ -1034,19 +1038,23 @@ VerifyCertPkcsSignedData (
                            being dispatched. This will optionally be used for logging.\r
   @param[in]    FileBuffer File buffer matches the input file device path.\r
   @param[in]    FileSize   Size of File buffer matches the input file device path.\r
-\r
-  @retval EFI_SUCCESS            The file specified by File did authenticate, and the\r
-                                 platform policy dictates that the DXE Core may use File.\r
-  @retval EFI_INVALID_PARAMETER  Input argument is incorrect.\r
+  @param[in]    BootPolicy A boot policy that was used to call LoadImage() UEFI service.\r
+\r
+  @retval EFI_SUCCESS            The file specified by DevicePath and non-NULL\r
+                                 FileBuffer did authenticate, and the platform policy dictates\r
+                                 that the DXE Foundation may use the file.\r
+  @retval EFI_SUCCESS            The device path specified by NULL device path DevicePath\r
+                                 and non-NULL FileBuffer did authenticate, and the platform\r
+                                 policy dictates that the DXE Foundation may execute the image in\r
+                                 FileBuffer.\r
   @retval EFI_OUT_RESOURCE       Fail to allocate memory.\r
   @retval EFI_SECURITY_VIOLATION The file specified by File did not authenticate, and\r
                                  the platform policy dictates that File should be placed\r
-                                 in the untrusted state. A file may be promoted from\r
-                                 the untrusted to the trusted state at a future time\r
-                                 with a call to the Trust() DXE Service.\r
-  @retval EFI_ACCESS_DENIED      The file specified by File did not authenticate, and\r
-                                 the platform policy dictates that File should not be\r
-                                 used for any purpose.\r
+                                 in the untrusted state. The image has been added to the file\r
+                                 execution table.\r
+  @retval EFI_ACCESS_DENIED      The file specified by File and FileBuffer did not\r
+                                 authenticate, and the platform policy dictates that the DXE\r
+                                 Foundation many not use File.\r
 \r
 **/\r
 EFI_STATUS\r
@@ -1055,7 +1063,8 @@ DxeImageVerificationHandler (
   IN  UINT32                           AuthenticationStatus,\r
   IN  CONST EFI_DEVICE_PATH_PROTOCOL   *File,\r
   IN  VOID                             *FileBuffer,\r
-  IN  UINTN                            FileSize\r
+  IN  UINTN                            FileSize,\r
+  IN  BOOLEAN                          BootPolicy\r
   )\r
 {\r
   EFI_STATUS                           Status;\r
@@ -1073,10 +1082,6 @@ DxeImageVerificationHandler (
   UINT32                               NumberOfRvaAndSizes;\r
   UINT32                               CertSize;\r
 \r
-  if (File == NULL) {\r
-    return EFI_INVALID_PARAMETER;\r
-  }\r
-\r
   SignatureList     = NULL;\r
   SignatureListSize = 0;\r
   WinCertificate    = NULL;\r
@@ -1326,6 +1331,7 @@ Done:
     // Policy decides to defer or reject the image; add its information in image executable information table.\r
     //\r
     AddImageExeInfo (Action, NULL, File, SignatureList, SignatureListSize);\r
+    Status = EFI_SECURITY_VIOLATION;\r
   }\r
 \r
   if (SignatureList != NULL) {\r
@@ -1410,7 +1416,7 @@ DxeImageVerificationLibConstructor (
     &Registration\r
     );\r
 \r
-  return RegisterSecurityHandler (\r
+  return RegisterSecurity2Handler (\r
           DxeImageVerificationHandler,\r
           EFI_AUTH_OPERATION_VERIFY_IMAGE | EFI_AUTH_OPERATION_IMAGE_REQUIRED\r
           );\r

diff --git a/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLib.c b/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLib.c
index d4616fa3c96fc6be48daac82379e48f996898b17..a55296098840859ed0dde205ff524a1fee1b0490 100644 (file)
--- a/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLib.c
+++ b/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLib.c
@@ -694,34 +694,28 @@ Finish:
   might be possible to use it at a future time, then EFI_SECURITY_VIOLATION is \r
   returned.\r
 \r
-  @param[in, out] AuthenticationStatus  This is the authentication status returned\r
+  @param[in]      AuthenticationStatus  This is the authentication status returned\r
                                         from the securitymeasurement services for the\r
                                         input file.\r
   @param[in]      File       This is a pointer to the device path of the file that is\r
                              being dispatched. This will optionally be used for logging.\r
   @param[in]      FileBuffer File buffer matches the input file device path.\r
   @param[in]      FileSize   Size of File buffer matches the input file device path.\r
+  @param[in]      BootPolicy A boot policy that was used to call LoadImage() UEFI service.\r
 \r
-  @retval EFI_SUCCESS            The file specified by File did authenticate, and the\r
-                                 platform policy dictates that the DXE Core may use File.\r
-  @retval EFI_INVALID_PARAMETER  File is NULL.\r
-  @retval EFI_SECURITY_VIOLATION The file specified by File did not authenticate, and\r
-                                 the platform policy dictates that File should be placed\r
-                                 in the untrusted state. A file may be promoted from\r
-                                 the untrusted to the trusted state at a future time\r
-                                 with a call to the Trust() DXE Service.\r
-  @retval EFI_ACCESS_DENIED      The file specified by File did not authenticate, and\r
-                                 the platform policy dictates that File should not be\r
-                                 used for any purpose.\r
-\r
+  @retval EFI_SUCCESS             The file specified by DevicePath and non-NULL\r
+                                  FileBuffer did authenticate, and the platform policy dictates\r
+                                  that the DXE Foundation may use the file.\r
+  @retval other error value\r
 **/\r
 EFI_STATUS\r
 EFIAPI\r
 DxeTpmMeasureBootHandler (\r
-  IN  OUT   UINT32                     AuthenticationStatus,\r
+  IN  UINT32                           AuthenticationStatus,\r
   IN  CONST EFI_DEVICE_PATH_PROTOCOL   *File,\r
-  IN  VOID                             *FileBuffer OPTIONAL,\r
-  IN  UINTN                            FileSize OPTIONAL\r
+  IN  VOID                             *FileBuffer,\r
+  IN  UINTN                            FileSize,\r
+  IN  BOOLEAN                          BootPolicy\r
   )\r
 {\r
   EFI_TCG_PROTOCOL                  *TcgProtocol;\r
@@ -736,10 +730,6 @@ DxeTpmMeasureBootHandler (
   BOOLEAN                           ApplicationRequired;\r
   PE_COFF_LOADER_IMAGE_CONTEXT      ImageContext;\r
 \r
-  if (File == NULL) {\r
-    return EFI_INVALID_PARAMETER;\r
-  }\r
-\r
   Status = gBS->LocateProtocol (&gEfiTcgProtocolGuid, NULL, (VOID **) &TcgProtocol);\r
   if (EFI_ERROR (Status)) {\r
     //\r
@@ -768,7 +758,6 @@ DxeTpmMeasureBootHandler (
   // Copy File Device Path\r
   //\r
   OrigDevicePathNode = DuplicateDevicePath (File);\r
-  ASSERT (OrigDevicePathNode != NULL);\r
   \r
   //\r
   // 1. Check whether this device path support BlockIo protocol.\r
@@ -928,7 +917,9 @@ DxeTpmMeasureBootHandler (
   // Done, free the allocated resource.\r
   //\r
 Finish:\r
-  FreePool (OrigDevicePathNode);\r
+  if (OrigDevicePathNode != NULL) {\r
+    FreePool (OrigDevicePathNode);\r
+  }\r
 \r
   return Status;\r
 }\r
@@ -949,7 +940,7 @@ DxeTpmMeasureBootLibConstructor (
   IN EFI_SYSTEM_TABLE  *SystemTable\r
   )\r
 {\r
-  return RegisterSecurityHandler (\r
+  return RegisterSecurity2Handler (\r
           DxeTpmMeasureBootHandler,\r
           EFI_AUTH_OPERATION_MEASURE_IMAGE | EFI_AUTH_OPERATION_IMAGE_REQUIRED\r
           );\r