product_policy/
uefi_security_policy.rs

1// Copyright (c) Microsoft Corporation.
2// Licensed under the MIT License.
3
4//! Shared validation for the currently enforced UEFI product-policy
5//! checks (secure-boot-required), used by product policy variants
6//! (Sivm, Cwcow, etc.).
7
8/// Internal trait providing access to policy fields needed by the
9/// shared validation logic. Kept crate-private so raw getters are not
10/// exposed outside the crate.
11pub(crate) trait UefiSecurityPolicyParams {
12    fn require_secure_boot(&self) -> bool;
13}
14
15/// A trait for validating UEFI security settings. Implementors only
16/// need to provide `UefiSecurityPolicyParams`; all methods here have
17/// default bodies, so policies can use an empty marker impl.
18#[expect(
19    private_bounds,
20    reason = "Params getters are intentionally crate-private; only default methods are public"
21)]
22pub trait UefiSecurityPolicy
23where
24    Self: UefiSecurityPolicyParams,
25{
26    /// Validate that secure boot is enabled if required by the policy.
27    fn validate_secure_boot_enabled(&self, on: bool) -> anyhow::Result<()> {
28        if self.require_secure_boot() && !on {
29            anyhow::bail!("product policy requires secure boot to be enabled");
30        }
31        Ok(())
32    }
33}
34
35#[cfg(test)]
36mod tests {
37    extern crate alloc;
38    use super::*;
39    use crate::sivm::SivmPolicy;
40    use alloc::string::ToString;
41
42    #[test]
43    fn secure_boot_flag_off_passes_either_way() {
44        let p = SivmPolicy::default();
45        assert!(p.validate_secure_boot_enabled(false).is_ok());
46        assert!(p.validate_secure_boot_enabled(true).is_ok());
47    }
48
49    #[test]
50    fn secure_boot_flag_on_passes_when_enabled() {
51        let p = SivmPolicy {
52            require_secure_boot: true,
53            ..Default::default()
54        };
55        assert!(p.validate_secure_boot_enabled(true).is_ok());
56    }
57
58    #[test]
59    fn secure_boot_flag_on_fails_when_disabled() {
60        let p = SivmPolicy {
61            require_secure_boot: true,
62            ..Default::default()
63        };
64        let err = p.validate_secure_boot_enabled(false).unwrap_err();
65        assert!(err.to_string().contains("secure boot"));
66    }
67}
product_policy/uefi_security_policy.rs

product_policy/
uefi_security_policy.rs
