tree 0bc0019f68d99bb4aa601430d2e26cf018615b16
parent 7618d4ad546c887c763dc1f9928ad44a88cebca7
author Josh Boyer <jwboyer@fedoraproject.org> 1485873960 +0000
committer Ard Biesheuvel <ard.biesheuvel@linaro.org> 1486140255 +0000

efi: Disable secure boot if shim is in insecure mode

A user can manually tell the shim boot loader to disable validation of
images it loads.  When a user does this, it creates a UEFI variable called
MokSBState that does not have the runtime attribute set.  Given that the
user explicitly disabled validation, we can honor that and not enable
secure boot mode if that variable is set.

Signed-off-by: Josh Boyer <jwboyer@fedoraproject.org>
Signed-off-by: David Howells <dhowells@redhat.com>
Cc: Matt Fleming <matt@codeblueprint.co.uk>
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>