OpenCoreMisc: Initial ScanPolicy support and prevent leaking some NVRAM vars to OS

ca110047 · vit9696 · 6ad8321d · ca110047 · ca110047 · ca110047
12 changed file
--- a/Application/Bootstrap/Bootstrap.inf
+++ b/Application/Bootstrap/Bootstrap.inf
@@ -37,6 +37,7 @@
 [Packages]
  OpenCorePkg/OpenCorePkg.dec
  OcSupportPkg/OcSupportPkg.dec
+  EfiPkg/EfiPkg.dec
  MdePkg/MdePkg.dec
  MdeModulePkg/MdeModulePkg.dec


--- a/Changelog.md
+++ b/Changelog.md
@@ -12,6 +12,7 @@ OpenCore Changelog
 - Dropped `UpdateSMBIOSMode` `Auto` mode in favour of `Create`
 - Fixed SMBIOS CPU detection for Xeon and Core models
 - Moved `ConsoleControl` configuration to `Protocols`
+- Added `Security` -> `ScanPolicy` preference

 #### v0.0.1
 - Initial developer preview release
--- a/Docs/Configuration.pdf
+++ b/Docs/Configuration.pdf
--- a/Docs/Configuration.tex
+++ b/Docs/Configuration.tex
@@ -1275,7 +1275,6 @@ behaviour that does not go to any other sections
  \textbf{Description}: Apply security configuration described in
  \hyperref[miscsecurityprops]{Security Properties} section below.

-
 \end{enumerate}

 \subsection{Boot Properties}\label{miscbootprops}
@@ -1605,6 +1604,71 @@ rm vault.pub
  can be found in \href{https://habr.com/post/273497/}{Taming UEFI SecureBoot}
  paper (in Russian).

+\item
+  \texttt{ScanPolicy}\\
+  \textbf{Type}: \texttt{plist\ integer}, 32 bit\\
+  \textbf{Default value}: \texttt{0xF0103}\\
+  \textbf{Description}: Define operating system detection policy.
+
+  This value allows to prevent scanning (and booting) from untrusted
+  source based on a bitmask (sum) of select flags. As it is not possible
+  to reliably detect every file system or device type, this feature
+  cannot be fully relied upon in open environments, and the additional
+  measures are to be applied.
+
+  Third party drivers may introduce additional security (and performance)
+  measures following the provided scan policy. Scan policy is exposed
+  in \texttt{scan-policy} variable of \texttt{4D1FDA02-38C7-4A6A-9CC6-4BCCA8B30102}
+  GUID for UEFI Boot Services only.
+
+  \begin{itemize}
+  \tightlist
+    \item \texttt{0x00000001} --- \texttt{OC\_SCAN\_FILE\_SYSTEM\_LOCK}, restricts
+    scanning to only known file systems defined as a part of this policy. File system
+    drivers may not be aware of this policy, and to avoid mounting of undesired file
+    systems it is best not to load its driver. This bit does not affect dmg mounting,
+    which may have any file system. Known file systems are prefixed with
+    \texttt{OC\_SCAN\_ALLOW\_FS\_}.
+    \item \texttt{0x00000002} --- \texttt{OC\_SCAN\_DEVICE\_LOCK}, restricts scanning
+    to only known device types defined as a part of this policy. This is not always possible
+    to detect protocol tunneling, so be aware that on some systems it may be possible for
+    e.g. USB HDDs to be recognised as SATA. Cases like this must be reported. Known device
+    types are prefixed with \texttt{OC\_SCAN\_ALLOW\_DEVICE\_}.
+    \item \texttt{0x00000100} --- \texttt{OC\_SCAN\_ALLOW\_FS\_APFS}, allows scanning
+    of APFS file system.
+    \item \texttt{0x00010000} --- \texttt{OC\_SCAN\_ALLOW\_DEVICE\_SATA}, allow
+    scanning SATA devices.
+    \item \texttt{0x00020000} --- \texttt{OC\_SCAN\_ALLOW\_DEVICE\_SASEX}, allow
+    scanning SAS and Mac NVMe devices.
+    \item \texttt{0x00040000} --- \texttt{OC\_SCAN\_ALLOW\_DEVICE\_SCSI}, allow
+    scanning SCSI devices.
+    \item \texttt{0x00080000} --- \texttt{OC\_SCAN\_ALLOW\_DEVICE\_NVME}, allow
+    scanning NVMe devices.
+    \item \texttt{0x00100000} --- \texttt{OC\_SCAN\_ALLOW\_DEVICE\_ATAPI}, allow
+    scanning CD/DVD devices.
+    \item \texttt{0x00200000} --- \texttt{OC\_SCAN\_ALLOW\_DEVICE\_USB}, allow
+    scanning USB devices.
+    \item \texttt{0x00400000} --- \texttt{OC\_SCAN\_ALLOW\_DEVICE\_FIREWIRE}, allow
+    scanning FireWire devices.
+    \item \texttt{0x00800000} --- \texttt{OC\_SCAN\_ALLOW\_DEVICE\_SDCARD}, allow
+    scanning card reader devices.
+  \end{itemize}
+
+  \emph{Note}: Given the above description, \texttt{0xF0103} value is expected to allow
+  scanning of SATA, SAS, SCSI, and NVMe devices with APFS file system, and prevent scanning
+  of any devices with HFS or FAT32 file systems in addition to not scanning APFS file systems
+  on USB, CD, USB, and FireWire drives. The combination reads as:
+  \begin{itemize}
+  \tightlist
+  \item \texttt{OC\_SCAN\_FILE\_SYSTEM\_LOCK}
+  \item \texttt{OC\_SCAN\_DEVICE\_LOCK}
+  \item \texttt{OC\_SCAN\_ALLOW\_FS\_APFS}
+  \item \texttt{OC\_SCAN\_ALLOW\_DEVICE\_SATA}
+  \item \texttt{OC\_SCAN\_ALLOW\_DEVICE\_SASEX}
+  \item \texttt{OC\_SCAN\_ALLOW\_DEVICE\_SCSI}
+  \item \texttt{OC\_SCAN\_ALLOW\_DEVICE\_NVME}
+  \end{itemize}
+
 \end{enumerate}

 \section{NVRAM}\label{nvram}

--- a/Docs/Differences/Differences.pdf
+++ b/Docs/Differences/Differences.pdf
--- a/Docs/Differences/Differences.tex
+++ b/Docs/Differences/Differences.tex
 \documentclass[]{article}
 %DIF LATEXDIFF DIFFERENCE FILE
 %DIF DEL PreviousConfiguration.tex   Fri May  3 12:13:06 2019
-%DIF ADD ../Configuration.tex        Tue May 14 07:48:46 2019
+%DIF ADD ../Configuration.tex        Wed May 15 01:27:22 2019

 \usepackage{lmodern}
 \usepackage{amssymb,amsmath}
@@ -1359,7 +1359,6 @@ behaviour that does not go to any other sections
  \textbf{Description}: Apply security configuration described in
  \hyperref[miscsecurityprops]{Security Properties} section below.

-
 \end{enumerate}

 \subsection{Boot Properties}\label{miscbootprops}
@@ -1761,7 +1760,75 @@ rm vault.pub
  can be found in \href{https://habr.com/post/273497/}{Taming UEFI SecureBoot}
  paper (in Russian).

-\end{enumerate}
+\DIFaddbegin \item
+  \texttt{\DIFadd{ScanPolicy}}\\
+  \textbf{\DIFadd{Type}}\DIFadd{: }\texttt{\DIFadd{plist\ integer}}\DIFadd{, 32 bit}\\
+  \textbf{\DIFadd{Default value}}\DIFadd{: }\texttt{\DIFadd{0xF0103}}\\
+  \textbf{\DIFadd{Description}}\DIFadd{: Define operating system detection policy.
+}
+
+  \DIFadd{This value allows to prevent scanning (and booting) from untrusted
+  source based on a bitmask (sum) of select flags. As it is not possible
+  to reliably detect every file system or device type, this feature
+  cannot be fully relied upon in open environments, and the additional
+  measures are to be applied.
+}
+
+  \DIFadd{Third party drivers may introduce additional security (and performance)
+  measures following the provided scan policy. Scan policy is exposed
+  in }\texttt{\DIFadd{scan-policy}} \DIFadd{variable of }\texttt{\DIFadd{4D1FDA02-38C7-4A6A-9CC6-4BCCA8B30102}}
+  \DIFadd{GUID for UEFI Boot Services only.
+}
+
+  \begin{itemize}
+  \tightlist
+    \item \texttt{\DIFadd{0x00000001}} \DIFadd{--- }\texttt{\DIFadd{OC\_SCAN\_FILE\_SYSTEM\_LOCK}}\DIFadd{, restricts
+    scanning to only known file systems defined as a part of this policy. File system
+    drivers may not be aware of this policy, and to avoid mounting of undesired file
+    systems it is best not to load its driver. This bit does not affect dmg mounting,
+    which may have any file system. Known file systems are prefixed with
+    }\texttt{\DIFadd{OC\_SCAN\_ALLOW\_FS\_}}\DIFadd{.
+    }\item \texttt{\DIFadd{0x00000002}} \DIFadd{--- }\texttt{\DIFadd{OC\_SCAN\_DEVICE\_LOCK}}\DIFadd{, restricts scanning
+    to only known device types defined as a part of this policy. This is not always possible
+    to detect protocol tunneling, so be aware that on some systems it may be possible for
+    e.g. USB HDDs to be recognised as SATA. Cases like this must be reported. Known device
+    types are prefixed with }\texttt{\DIFadd{OC\_SCAN\_ALLOW\_DEVICE\_}}\DIFadd{.
+    }\item \texttt{\DIFadd{0x00000100}} \DIFadd{--- }\texttt{\DIFadd{OC\_SCAN\_ALLOW\_FS\_APFS}}\DIFadd{, allows scanning
+    of APFS file system.
+    }\item \texttt{\DIFadd{0x00010000}} \DIFadd{--- }\texttt{\DIFadd{OC\_SCAN\_ALLOW\_DEVICE\_SATA}}\DIFadd{, allow
+    scanning SATA devices.
+    }\item \texttt{\DIFadd{0x00020000}} \DIFadd{--- }\texttt{\DIFadd{OC\_SCAN\_ALLOW\_DEVICE\_SASEX}}\DIFadd{, allow
+    scanning SAS and Mac NVMe devices.
+    }\item \texttt{\DIFadd{0x00040000}} \DIFadd{--- }\texttt{\DIFadd{OC\_SCAN\_ALLOW\_DEVICE\_SCSI}}\DIFadd{, allow
+    scanning SCSI devices.
+    }\item \texttt{\DIFadd{0x00080000}} \DIFadd{--- }\texttt{\DIFadd{OC\_SCAN\_ALLOW\_DEVICE\_NVME}}\DIFadd{, allow
+    scanning NVMe devices.
+    }\item \texttt{\DIFadd{0x00100000}} \DIFadd{--- }\texttt{\DIFadd{OC\_SCAN\_ALLOW\_DEVICE\_ATAPI}}\DIFadd{, allow
+    scanning CD/DVD devices.
+    }\item \texttt{\DIFadd{0x00200000}} \DIFadd{--- }\texttt{\DIFadd{OC\_SCAN\_ALLOW\_DEVICE\_USB}}\DIFadd{, allow
+    scanning USB devices.
+    }\item \texttt{\DIFadd{0x00400000}} \DIFadd{--- }\texttt{\DIFadd{OC\_SCAN\_ALLOW\_DEVICE\_FIREWIRE}}\DIFadd{, allow
+    scanning FireWire devices.
+    }\item \texttt{\DIFadd{0x00800000}} \DIFadd{--- }\texttt{\DIFadd{OC\_SCAN\_ALLOW\_DEVICE\_SDCARD}}\DIFadd{, allow
+    scanning card reader devices.
+  }\end{itemize}
+
+  \emph{\DIFadd{Note}}\DIFadd{: Given the above description, }\texttt{\DIFadd{0xF0103}} \DIFadd{value is expected to allow
+  scanning of SATA, SAS, SCSI, and NVMe devices with APFS file system, and prevent scanning
+  of any devices with HFS or FAT32 file systems in addition to not scanning APFS file systems
+  on USB, CD, USB, and FireWire drives. The combination reads as:
+  }\begin{itemize}
+  \tightlist
+  \item \texttt{\DIFadd{OC\_SCAN\_FILE\_SYSTEM\_LOCK}}
+  \item \texttt{\DIFadd{OC\_SCAN\_DEVICE\_LOCK}}
+  \item \texttt{\DIFadd{OC\_SCAN\_ALLOW\_FS\_APFS}}
+  \item \texttt{\DIFadd{OC\_SCAN\_ALLOW\_DEVICE\_SATA}}
+  \item \texttt{\DIFadd{OC\_SCAN\_ALLOW\_DEVICE\_SASEX}}
+  \item \texttt{\DIFadd{OC\_SCAN\_ALLOW\_DEVICE\_SCSI}}
+  \item \texttt{\DIFadd{OC\_SCAN\_ALLOW\_DEVICE\_NVME}}
+  \end{itemize}
+
+\DIFaddend \end{enumerate}

 \section{NVRAM}\label{nvram}


--- a/Docs/Sample.plist
+++ b/Docs/Sample.plist
@@ -417,6 +417,8 @@
 			<true/>
 			<key>RequireVault</key>
 			<true/>
+			<key>ScanPolicy</key>
+			<integer>983299</integer>
 		</dict>
 	</dict>
 	<key>NVRAM</key>

--- a/Docs/SampleFull.plist
+++ b/Docs/SampleFull.plist
@@ -417,6 +417,8 @@
 			<true/>
 			<key>RequireVault</key>
 			<true/>
+			<key>ScanPolicy</key>
+			<integer>983299</integer>
 		</dict>
 	</dict>
 	<key>NVRAM</key>

--- a/Include/OpenCore.h
+++ b/Include/OpenCore.h
@@ -70,6 +70,8 @@

 #define OPEN_CORE_NVRAM_ATTR       (EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS)

+#define OPEN_CORE_INT_NVRAM_ATTR   EFI_VARIABLE_BOOTSERVICE_ACCESS
+
 /**
  Obtain cryptographic key if it was installed.


--- a/Platform/OpenCore/OpenCore.c
+++ b/Platform/OpenCore/OpenCore.c
@@ -239,7 +239,7 @@ OcMain (
  DEBUG ((DEBUG_INFO, "OC: OpenCore is loaded, showing boot menu...\n"));

  Status = OcRunSimpleBootPicker (
-    OC_SCAN_DEFAULT_POLICY,
+    mOpenCoreConfiguration.Misc.Security.ScanPolicy,
    OC_LOAD_DEFAULT_POLICY,
    mOpenCoreConfiguration.Misc.Boot.Timeout,
    OcStartImage,

--- a/Platform/OpenCore/OpenCoreMisc.c
+++ b/Platform/OpenCore/OpenCoreMisc.c
@@ -270,6 +270,17 @@ OcMiscUefiQuirksLoaded (
  IN OC_GLOBAL_CONFIG   *Config
  )
 {
+  //
+  // Inform drivers about our scan policy.
+  //
+  gRT->SetVariable (
+    OC_SCAN_POLICY_VARIABLE_NAME,
+    &gOcVendorVariableGuid,
+    OPEN_CORE_INT_NVRAM_ATTR,
+    sizeof (Config->Misc.Security.ScanPolicy),
+    &Config->Misc.Security.ScanPolicy
+    );
+
  OcConsoleControlSetBehaviour (
    ParseConsoleControlBehaviour (
      OC_BLOB_GET (&Config->Misc.Boot.ConsoleBehaviourUi)

--- a/Platform/OpenCore/OpenCoreUefi.c
+++ b/Platform/OpenCore/OpenCoreUefi.c
@@ -290,7 +290,7 @@ OcLoadUefiSupport (
  gRT->SetVariable (
    OC_BOOT_REDIRECT_VARIABLE_NAME,
    &gOcVendorVariableGuid,
-    OPEN_CORE_NVRAM_ATTR,
+    OPEN_CORE_INT_NVRAM_ATTR,
    sizeof (Config->Uefi.Quirks.RequestBootVarRouting),
    &Config->Uefi.Quirks.RequestBootVarRouting
    );