Supply unsigned xml based on system operation mode #31
Conversation
|
I'm confused as to the Peim's name, ConfDfciUnsignedListInit. The Peim is setting a Pcd buffer with a specific guid. Why is the peim named Unsigned List init? |
Because this module is supposed to populate the file GUID of the xml that DFCI will look up for unsigned settings. The idea is that before the DFCI has a chance to look at the file guid PCD, this PEIM will update the PCD content based on the system operation mode. If this is MFG mode, that means the unsigned settings will be accepted, thus the file GUID PCD contains a legit value. Otherwise, it will be supplied with a bogus/null value so that DFCI will not be able to locate any xml and eventually not taking any unsigned settings. |
|
Tested on QEMU and verified that the system will not accept any unsigned settings when the system is in MFG mode. |
| ## @file | ||
| # Initialize DFCI unsigned list. | ||
| # | ||
| # Copyright (C) Microsoft Corporation. |
There was a problem hiding this comment.
Shoot, i missed this one... sorry
This change will change the DFCI unsigned setting's XML file GUID based on the current system mode. Such that on non-MFG mode, the DFCI will not accept unsigned settings. When the system is in MFG mode, the system will only block the settings listed in the XML file.