| commit | 92ad19559ea9a8ec6f158480934ae26ebfe2c14f | [log] [tgz] |
|---|---|---|
| author | Lee, Chun-Yi <joeyli.kernel@gmail.com> | Sat Dec 18 10:09:05 2021 +0800 |
| committer | Mimi Zohar <zohar@linux.ibm.com> | Fri Dec 24 10:25:24 2021 -0500 |
| tree | 7cab118eacabaecc222cbc63040de48a016005ee | |
| parent | 54bf7fa3efd08eea03e4bac04e188ee3db6173a7 [diff] |
integrity: Do not load MOK and MOKx when secure boot be disabled The security of Machine Owner Key (MOK) relies on secure boot. When secure boot is disabled, EFI firmware will not verify binary code. Then arbitrary efi binary code can modify MOK when rebooting. This patch prevents MOK/MOKx be loaded when secure boot be disabled. Signed-off-by: "Lee, Chun-Yi" <jlee@suse.com> Reviewed-by: Petr Vorel <pvorel@suse.cz> Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>