From 5db28a6753d307cdfb1cfdeb2f63739a9f959837 Mon Sep 17 00:00:00 2001 From: lgao4 Date: Wed, 22 Aug 2012 02:33:00 +0000 Subject: Add PI1.2.1 SAP2 support and UEFI231B mantis 896 1. Update three Security Handlers to depend on new SecurityManagementLib APIs to register Security service for SAP2 Signed-off-by: Liming Gao Reviewed-by: Guo Dong git-svn-id: https://edk2.svn.sourceforge.net/svnroot/edk2/trunk/edk2@13661 6f19259b-4bc3-4df7-8a09-765794883524 --- .../DxeDeferImageLoadLib/DxeDeferImageLoadLib.c | 43 +++++++++++++--------- 1 file changed, 25 insertions(+), 18 deletions(-) (limited to 'SecurityPkg/Library/DxeDeferImageLoadLib') diff --git a/SecurityPkg/Library/DxeDeferImageLoadLib/DxeDeferImageLoadLib.c b/SecurityPkg/Library/DxeDeferImageLoadLib/DxeDeferImageLoadLib.c index 84b8cf7884..fd18d2f7e7 100644 --- a/SecurityPkg/Library/DxeDeferImageLoadLib/DxeDeferImageLoadLib.c +++ b/SecurityPkg/Library/DxeDeferImageLoadLib/DxeDeferImageLoadLib.c @@ -714,18 +714,22 @@ GetDefferedImageInfo ( logging. @param[in] FileBuffer File buffer matches the input file device path. @param[in] FileSize Size of File buffer matches the input file device path. - - @retval EFI_SUCCESS The file specified by File did authenticate, and the - platform policy dictates that the DXE Core may use File. - @retval EFI_INVALID_PARAMETER File is NULL. - @retval EFI_SECURITY_VIOLATION The file specified by File did not authenticate, and - the platform policy dictates that File should be placed - in the untrusted state. A file may be promoted from - the untrusted to the trusted state at a future time - with a call to the Trust() DXE Service. - @retval EFI_ACCESS_DENIED The file specified by File did not authenticate, and - the platform policy dictates that File should not be - used for any purpose. + @param[in] BootPolicy A boot policy that was used to call LoadImage() UEFI service. + + @retval EFI_SUCCESS FileBuffer is NULL and current user has permission to start + UEFI device drivers on the device path specified by DevicePath. + @retval EFI_SUCCESS The file specified by DevicePath and non-NULL + FileBuffer did authenticate, and the platform policy dictates + that the DXE Foundation may use the file. + @retval EFI_SECURITY_VIOLATION FileBuffer is NULL and the user has no + permission to start UEFI device drivers on the device path specified + by DevicePath. + @retval EFI_SECURITY_VIOLATION FileBuffer is not NULL and the user has no permission to load + drivers from the device path specified by DevicePath. The + image has been added into the list of the deferred images. + @retval EFI_ACCESS_DENIED The file specified by File and FileBuffer did not + authenticate, and the platform policy dictates that the DXE + Foundation many not use File. **/ EFI_STATUS @@ -734,17 +738,20 @@ DxeDeferImageLoadHandler ( IN UINT32 AuthenticationStatus, IN CONST EFI_DEVICE_PATH_PROTOCOL *File, IN VOID *FileBuffer, - IN UINTN FileSize + IN UINTN FileSize, + IN BOOLEAN BootPolicy ) - { EFI_STATUS Status; EFI_USER_PROFILE_HANDLE CurrentUser; UINT32 Policy; UINT32 FileType; + // + // Ignore if File is NULL. + // if (File == NULL) { - return EFI_INVALID_PARAMETER; + return EFI_SUCCESS; } // @@ -759,7 +766,7 @@ DxeDeferImageLoadHandler ( // if (!VerifyDevicePath (File)) { DEBUG ((EFI_D_ERROR, "[Security] The image is forbidden to load!\n")); - return EFI_ACCESS_DENIED; + return EFI_SECURITY_VIOLATION; } return EFI_SUCCESS; } @@ -779,7 +786,7 @@ DxeDeferImageLoadHandler ( } DEBUG ((EFI_D_ERROR, "[Security] No user identified, the image is deferred to load!\n")); - PutDefferedImageInfo (File, NULL, 0); + PutDefferedImageInfo (File, FileBuffer, FileSize); // // Install the Deferred Image Load Protocol onto a new handle. @@ -849,7 +856,7 @@ DxeDeferImageLoadLibConstructor ( &Registration ); - return RegisterSecurityHandler ( + return RegisterSecurity2Handler ( DxeDeferImageLoadHandler, EFI_AUTH_OPERATION_DEFER_IMAGE_LOAD ); -- cgit v1.2.3