Make sure we default to assuming we're locked down.

If "SecureBoot" exists but "SetupMode" does not, assume "SetupMode" says
we're not in Setup Mode.

Signed-off-by: Peter Jones <pjones@redhat.com>

1 files changed, 7 insertions, 1 deletions

diff --git a/shim.c b/shim.c
index 14fb601c..fe73ec1a 100644
--- a/shim.c
+++ b/shim.c
@@ -484,7 +484,13 @@ static BOOLEAN secure_mode (void)
 		return FALSE;
 	}
 
-	if (variable_is_setupmode() == 1) {
+	/* If we /do/ have "SecureBoot", but /don't/ have "SetupMode",
+	 * then the implementation is bad, but we assume that secure boot is
+	 * enabled according to the status of "SecureBoot".  If we have both
+	 * of them, then "SetupMode" may tell us additional data, and we need
+	 * to consider it.
+	 */
+	if (variable_is_setupmode(0) == 1) {
 		if (verbose && !in_protocol)
 			console_notify(L"Platform is in setup mode");
 		return FALSE;