If the image is signed but not allowed by DB and the hash of image is not found in DB/DBX, then the EFI_IMAGE_INFO_ACTION of the load of said image should be set to, EFI_IMAGE_EXECUTION_AUTH_SIG_NOT_FOUND, rather then being left unset as EFI_IMAGE_EXECUTION_AUTH_UNTESTED.
Cc: Jiewen Yao <jiewen....@intel.com> Cc: Jian J Wang <jian.j.w...@intel.com> Cc: Min Xu <min.m...@intel.com> Signed-off-by: Joseph Hemann <joseph.hem...@arm.com> Change-Id: I6b2777bd7aeb57773b8876e44c2179ea7501bc8c --- .../Library/DxeImageVerificationLib/DxeImageVerificationLib.c | 1 + 1 file changed, 1 insertion(+) diff --git a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c index c48861cd6496..0a804af2162f 100644 --- a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c +++ b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c @@ -1957,6 +1957,7 @@ DxeImageVerificationHandler ( if (!EFI_ERROR (DbStatus) && IsFound) { IsVerified = TRUE; } else { + Action = EFI_IMAGE_EXECUTION_AUTH_SIG_NOT_FOUND; DEBUG ((DEBUG_INFO, "DxeImageVerificationLib: Image is signed but signature is not allowed by DB and %s hash of image is not found in DB/DBX.\n", mHashTypeStr)); } } -- 2.17.1 -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#81837): https://edk2.groups.io/g/devel/message/81837 Mute This Topic: https://groups.io/mt/86267146/21656 Group Owner: devel+ow...@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-