Policy V2: AcceptedTcbStatus evaluation logic only allow "ConfigurationNeeded"
- Dominant language
- Rust
- Stars
- 58
- Forks
- 43
- Avg merge
- 1d 19h
- Merged PRs (30d)
- 22
Description
*Code Reference: [policy.rs lines 774-794](https://github.com/intel/MigTD/blob/2d70988299e598b3858d7d36a0bf573cc31dd169/src/policy/src/v2/policy.rs#L727-L794)*
The `allow-list` for `tcbStatusAccepted` is only meaningful when `"ConfigurationNeeded"` is specified in the list. For all other TCB status values (UpToDate, SWHardeningNeeded, OutOfDate, Revoked), the `allow-list` has no effect because these statuses are already handled by the hardcoded ALWAYS_ALLOW/ALWAYS_DENY rules (lines 731-751).
If `"ConfigurationAndSWHardeningNeeded"` or `"OutOfDateConfigurationNeeded"` are specified directly in the allow-list without `"ConfigurationNeeded"`, they will be **ignored** and the `"policy_allow"` list will not be populated at line 774. These statuses are only honored when `"ConfigurationNeeded"` is specified. Direct specification of these variants has no effect.
Is that intended?
Additionally, why we hard code `OutOfDate`,`SWHardeningNeeded` as always allowed? should we allow policy to change?
Contributor guide
Assessment
This issue has not been assessed yet.