From 2670c6a17edb239949152c471445fc533d8525aa Mon Sep 17 00:00:00 2001 From: Eric Snowberg Date: Thu, 17 Feb 2022 18:29:58 -0500 Subject: Allow MokListTrusted to be enabled by default Within previous versions of shim the MokListTrusted var did not exist. The user had to opt in to using the feature. Change the default behavior to an opt out model. Since old shims will not have the BS MokListTrusted set, use inverse logic that sets the MokListTrustedRT to 1 when the boot service variable is missing. Many Linux distros carry out of tree patches to trust the mok keys by default. These out of tree patches can be dropped when using a Linux kernel that supports MokListTrustedRT. Signed-off-by: Eric Snowberg --- include/test-data-efivars-1.h | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'include') diff --git a/include/test-data-efivars-1.h b/include/test-data-efivars-1.h index 55090ede..2831bd23 100644 --- a/include/test-data-efivars-1.h +++ b/include/test-data-efivars-1.h @@ -102,5 +102,9 @@ static const unsigned char test_data_efivars_1_SbatLevelRT[] = { 0x32, 0x31, 0x30, 0x33, 0x30, 0x32, 0x31, 0x38, 0x0a }; +static const unsigned char test_data_efivars_1_MokListTrustedRT[] ={ + 0x01 +}; + #endif /* !TEST_DATA_EFIVARS_1_H_ */ // vim:fenc=utf-8:tw=75:noet -- cgit v1.2.3