It seems make sense. Would you please: 1) Fila a Bugzilla - https://bugzilla.tianocore.org/ 2) Describe what unit test you have done. Especially, if multiple cert list/data have been tested. I ask this because we use a for-loop to check cert in list one by one.
Thank you Yao Jiewen > -----Original Message----- > From: devel@edk2.groups.io <devel@edk2.groups.io> On Behalf Of Joseph > Hemann > Sent: Tuesday, October 12, 2021 9:12 PM > To: devel@edk2.groups.io > Cc: n...@arm.com; Joseph Hemann <joseph.hem...@arm.com>; Yao, Jiewen > <jiewen....@intel.com>; Wang, Jian J <jian.j.w...@intel.com>; Xu, Min M > <min.m...@intel.com> > Subject: [edk2-devel] [PATCH] SecurityPkg/DxeImageVerificationLib: Set Action > for failed signed image > > From: Joseph Hemann <joseph.hem...@arm.com> > > If the image is signed but not allowed by DB and the hash of > image is not found in DB/DBX, then the EFI_IMAGE_INFO_ACTION > of the load of said image should be set to, > EFI_IMAGE_EXECUTION_AUTH_SIG_NOT_FOUND, rather then being left > unset as EFI_IMAGE_EXECUTION_AUTH_UNTESTED. > > Cc: Jiewen Yao <jiewen....@intel.com> > Cc: Jian J Wang <jian.j.w...@intel.com> > Cc: Min Xu <min.m...@intel.com> > > Signed-off-by: Joseph Hemann <joseph.hem...@arm.com> > Change-Id: I271fb61384e5b8bb5ac23ccba5de9ba77adb85ad > --- > .../Library/DxeImageVerificationLib/DxeImageVerificationLib.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git > a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c > b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c > index c48861cd64..0a804af216 100644 > --- a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c > +++ b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c > @@ -1957,6 +1957,7 @@ DxeImageVerificationHandler ( > if (!EFI_ERROR (DbStatus) && IsFound) { > IsVerified = TRUE; > } else { > + Action = EFI_IMAGE_EXECUTION_AUTH_SIG_NOT_FOUND; > DEBUG ((DEBUG_INFO, "DxeImageVerificationLib: Image is signed but > signature is not allowed by DB and %s hash of image is not found in > DB/DBX.\n", > mHashTypeStr)); > } > } > -- > 2.17.1 > > > > > -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#81863): https://edk2.groups.io/g/devel/message/81863 Mute This Topic: https://groups.io/mt/86282200/21656 Group Owner: devel+ow...@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-