diff options
Diffstat (limited to 'debian/patches/features/all/db-mok-keyring/trust-machine-keyring-by-default.patch')
| -rw-r--r-- | debian/patches/features/all/db-mok-keyring/trust-machine-keyring-by-default.patch | 16 |
1 files changed, 16 insertions, 0 deletions
diff --git a/debian/patches/features/all/db-mok-keyring/trust-machine-keyring-by-default.patch b/debian/patches/features/all/db-mok-keyring/trust-machine-keyring-by-default.patch new file mode 100644 index 000000000..7c32a018f --- /dev/null +++ b/debian/patches/features/all/db-mok-keyring/trust-machine-keyring-by-default.patch @@ -0,0 +1,16 @@ +Author: Luca Boccassi <bluca@debian.org> +Description: trust machine keyring (MoK) by default + Debian always trusted keys in MoK by default. Upstream made it conditional on + a new EFI variable being set. To keep backward compatibility skip this check. +--- a/security/integrity/platform_certs/machine_keyring.c ++++ b/security/integrity/platform_certs/machine_keyring.c +@@ -69,8 +69,7 @@ + if (!initialized) { + initialized = true; + +- if (uefi_check_trust_mok_keys()) +- trust_mok = true; ++ trust_mok = true; + } + + return trust_mok; |