From 2d9fb19d38a1ab0905406c1902e2a25968049ebf Mon Sep 17 00:00:00 2001 From: Cyrus <24922493+cyrus-dev@users.noreply.github.com> Date: Wed, 10 Nov 2021 07:27:33 -0500 Subject: [PATCH] Updated the new polices after doing a bit of testing to make sure that they do ignore when there is a failure on that specific bit. --- .../service/SupplyChainValidationServiceImpl.java | 5 ----- .../portal/page/controllers/PolicyPageController.java | 7 ++++--- HIRS_Utils/src/main/java/hirs/data/persist/PCRPolicy.java | 8 +++----- 3 files changed, 7 insertions(+), 13 deletions(-) diff --git a/HIRS_AttestationCA/src/main/java/hirs/attestationca/service/SupplyChainValidationServiceImpl.java b/HIRS_AttestationCA/src/main/java/hirs/attestationca/service/SupplyChainValidationServiceImpl.java index 41e2db7e..98bf7d33 100644 --- a/HIRS_AttestationCA/src/main/java/hirs/attestationca/service/SupplyChainValidationServiceImpl.java +++ b/HIRS_AttestationCA/src/main/java/hirs/attestationca/service/SupplyChainValidationServiceImpl.java @@ -543,11 +543,6 @@ public class SupplyChainValidationServiceImpl implements SupplyChainValidationSe eventValueMap.put(rdv.getDigestValue(), rdv); } -// for (TpmPcrEvent tpe : tcgMeasurementLog.getEventList()) { -// if (!eventValueMap.containsKey(tpe.getEventDigestStr())) { -// tpmPcrEvents.add(tpe); -// } -// } tpmPcrEvents.addAll(pcrPolicy.validateTpmEvents( tcgMeasurementLog, eventValueMap)); } diff --git a/HIRS_AttestationCAPortal/src/main/java/hirs/attestationca/portal/page/controllers/PolicyPageController.java b/HIRS_AttestationCAPortal/src/main/java/hirs/attestationca/portal/page/controllers/PolicyPageController.java index 9cd5d7ca..f6f3e43c 100644 --- a/HIRS_AttestationCAPortal/src/main/java/hirs/attestationca/portal/page/controllers/PolicyPageController.java +++ b/HIRS_AttestationCAPortal/src/main/java/hirs/attestationca/portal/page/controllers/PolicyPageController.java @@ -866,16 +866,17 @@ public class PolicyPageController extends PageController { // set the policy option and create success message if (ignoreOsEvtOptionEnabled) { policy.getPcrPolicy().setEnableIgnoreOsEvt(true); - successMessage = "Ignore GPT enabled"; + policy.getPcrPolicy().setEnableIgnoreGpt(true); + successMessage = "Ignore OS Events enabled"; } else { policy.getPcrPolicy().setEnableIgnoreOsEvt(false); - successMessage = "Ignore GPT disabled"; + successMessage = "Ignore OS Events disabled"; } savePolicyAndApplySuccessMessage(ppModel, model, messages, successMessage, policy); } catch (PolicyManagerException e) { handlePolicyManagerUpdateError(model, messages, e, - "Error changing ACA Os Events ignore policy", + "Error changing ACA OS Events ignore policy", "Error updating policy. \n" + e.getMessage()); } diff --git a/HIRS_Utils/src/main/java/hirs/data/persist/PCRPolicy.java b/HIRS_Utils/src/main/java/hirs/data/persist/PCRPolicy.java index 2a7a473c..0a2dd19c 100644 --- a/HIRS_Utils/src/main/java/hirs/data/persist/PCRPolicy.java +++ b/HIRS_Utils/src/main/java/hirs/data/persist/PCRPolicy.java @@ -129,11 +129,8 @@ public final class PCRPolicy extends Policy { final Map eventValueMap) { List tpmPcrEvents = new LinkedList<>(); for (TpmPcrEvent tpe : tcgMeasurementLog.getEventList()) { - if (enableIgnoreIma && tpe.getPcrIndex() == IMA_PCR) { LOGGER.info(String.format("IMA Ignored -> %s", tpe)); - } else if (enableIgnoreGpt && tpe.getPcrIndex() == GPT_PCR) { - LOGGER.info(String.format("GPT Ignored -> %s", tpe)); } else if (enableIgnoretBoot && (tpe.getPcrIndex() >= TBOOT_PCR_START && tpe.getPcrIndex() <= TBOOT_PCR_END)) { LOGGER.info(String.format("TBOOT Ignored -> %s", tpe)); @@ -141,8 +138,9 @@ public final class PCRPolicy extends Policy { && tpe.getPcrIndex() <= PXE_PCR_END)) { LOGGER.info(String.format("OS Evt Ignored -> %s", tpe)); } else { - if (enableIgnoreOsEvt && (tpe.getEventTypeStr().contains(EVT_EFI_BOOT) - || tpe.getEventTypeStr().contains(EVT_EFI_GPT) + if (enableIgnoreGpt && tpe.getEventTypeStr().contains(EVT_EFI_GPT)) { + LOGGER.info(String.format("GPT Ignored -> %s", tpe)); + } else if (enableIgnoreOsEvt && (tpe.getEventTypeStr().contains(EVT_EFI_BOOT) || tpe.getEventTypeStr().contains(EVT_EFI_VAR))) { LOGGER.info(String.format("OS Evt Ignored -> %s", tpe)); } else if (enableIgnoreOsEvt && (tpe.getEventTypeStr().contains(EVT_EFI_CFG)