summaryrefslogtreecommitdiffstats
path: root/debian/patches/features/all/db-mok-keyring/trust-machine-keyring-by-default.patch
diff options
context:
space:
mode:
authorDaniel Baumann <daniel.baumann@progress-linux.org>2024-04-07 18:49:59 +0000
committerDaniel Baumann <daniel.baumann@progress-linux.org>2024-04-07 18:49:59 +0000
commit01997497f915e8f79871f3f2acb55ac465051d24 (patch)
tree1ce1afd7246e1014199e15cbf854bf7924458e5d /debian/patches/features/all/db-mok-keyring/trust-machine-keyring-by-default.patch
parentAdding upstream version 6.1.76. (diff)
downloadlinux-01997497f915e8f79871f3f2acb55ac465051d24.tar.xz
linux-01997497f915e8f79871f3f2acb55ac465051d24.zip
Adding debian version 6.1.76-1.debian/6.1.76-1
Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
Diffstat (limited to '')
-rw-r--r--debian/patches/features/all/db-mok-keyring/trust-machine-keyring-by-default.patch16
1 files changed, 16 insertions, 0 deletions
diff --git a/debian/patches/features/all/db-mok-keyring/trust-machine-keyring-by-default.patch b/debian/patches/features/all/db-mok-keyring/trust-machine-keyring-by-default.patch
new file mode 100644
index 000000000..7c32a018f
--- /dev/null
+++ b/debian/patches/features/all/db-mok-keyring/trust-machine-keyring-by-default.patch
@@ -0,0 +1,16 @@
+Author: Luca Boccassi <bluca@debian.org>
+Description: trust machine keyring (MoK) by default
+ Debian always trusted keys in MoK by default. Upstream made it conditional on
+ a new EFI variable being set. To keep backward compatibility skip this check.
+--- a/security/integrity/platform_certs/machine_keyring.c
++++ b/security/integrity/platform_certs/machine_keyring.c
+@@ -69,8 +69,7 @@
+ if (!initialized) {
+ initialized = true;
+
+- if (uefi_check_trust_mok_keys())
+- trust_mok = true;
++ trust_mok = true;
+ }
+
+ return trust_mok;