Fix handling of ignore_db and user_insecure_mode

Extra patch from upstream

diff --git a/debian/patches/fix-import_one_mok_state.patch b/debian/patches/fix-import_one_mok_state.patch
new file mode 100644 (file)
index 0000000..995a864
--- /dev/null
+++ b/debian/patches/fix-import_one_mok_state.patch
@@ -0,0 +1,36 @@
+commit 822d07ad4f07ef66fe447a130e1027c88d02a394
+Author: Adam Williamson <awilliam@redhat.com>
+Date:   Thu Apr 8 22:39:02 2021 -0700
+
+    Fix handling of ignore_db and user_insecure_mode
+    
+    In 65be350308783a8ef537246c8ad0545b4e6ad069, import_mok_state() is split
+    up into a function that manages the whole mok state, and one that
+    handles the state machine for an individual state variable.
+    Unfortunately, the code that initializes the global ignore_db and
+    user_insecure_mode was copied from import_mok_state() into the new
+    import_one_mok_state() function, and thus re-initializes that state each
+    time it processes a MoK state variable, before even assessing if that
+    variable is set.  As a result, we never honor either flag, and the
+    machine owner cannot disable trusting the system firmware's db/dbx
+    databases or disable validation altogether.
+    
+    This patch removes the extra re-initialization, allowing those variables
+    to be set properly.
+    
+    Signed-off-by: Adam Williamson <awilliam@redhat.com>
+
+diff --git a/mok.c b/mok.c
+index 5ad9072b..9e37d6ab 100644
+--- a/mok.c
++++ b/mok.c
+@@ -888,9 +888,6 @@ EFI_STATUS import_one_mok_state(struct mok_state_variable *v,
+       EFI_STATUS ret = EFI_SUCCESS;
+       EFI_STATUS efi_status;
+ 
+-      user_insecure_mode = 0;
+-      ignore_db = 0;
+-
+       UINT32 attrs = 0;
+       BOOLEAN delete = FALSE;
+ 

diff --git a/debian/patches/series b/debian/patches/series
index 6e64743f60fad4ee664ddbffdc51377eb6889188..0ffe2a27524f0f041d686631f4f76f827440bb4b 100644 (file)
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -1,2 +1,3 @@
+fix-import_one_mok_state.patch
 fix-broken-ia32-reloc.patch
 MOK-BootServicesData.patch