SecurityPkg: limit verification of enrolled PK in setup mode

[mirror_edk2.git] / SecurityPkg / SecurityPkg.dec

diff --git a/SecurityPkg/SecurityPkg.dec b/SecurityPkg/SecurityPkg.dec
index 8257f11d17c7677293a19c68c8fa6a230bac4542..d3b7ad7ff6fb895f7e2fb8c909ca6a62041185e4 100644 (file)
--- a/SecurityPkg/SecurityPkg.dec
+++ b/SecurityPkg/SecurityPkg.dec
@@ -580,5 +580,12 @@
   ## This PCD records LASA field in CC EVENTLOG ACPI table.\r
   gEfiSecurityPkgTokenSpaceGuid.PcdCcEventlogAcpiTableLasa|0|UINT64|0x00010026\r
 \r
+[PcdsFeatureFlag]\r
+  ## Indicates if the platform requires PK to be self-signed when setting the PK in setup mode.\r
+  #   TRUE  - Require PK to be self-signed.\r
+  #   FALSE - Do not require PK to be self-signed.\r
+  # @Prompt Require PK to be self-signed\r
+  gEfiMdeModulePkgTokenSpaceGuid.PcdRequireSelfSignedPk|TRUE|BOOLEAN|0x00010027\r
+\r
 [UserExtensions.TianoCore."ExtraFiles"]\r
   SecurityPkgExtra.uni\r