From: Luca Boccassi <bluca@debian.org>
Date: Fri, 25 Apr 2025 19:51:43 +0000 (+0200)
Subject: trust machine keyring (MoK) by default
X-Git-Tag: archive/raspbian/6.1.135-1+rpi1^2~59
X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=09ae18edad13d4f1890cf2577ee2b85babdb2dd3;p=linux.git

trust machine keyring (MoK) by default

Debian always trusted keys in MoK by default. Upstream made it conditional on
a new EFI variable being set. To keep backward compatibility skip this check.

Gbp-Pq: Topic features/all/db-mok-keyring
Gbp-Pq: Name trust-machine-keyring-by-default.patch
---

diff --git a/security/integrity/platform_certs/machine_keyring.c b/security/integrity/platform_certs/machine_keyring.c
index 7aaed7950b6..416da7b788a 100644
--- a/security/integrity/platform_certs/machine_keyring.c
+++ b/security/integrity/platform_certs/machine_keyring.c
@@ -69,8 +69,7 @@ bool __init trust_moklist(void)
 	if (!initialized) {
 		initialized = true;
 
-		if (uefi_check_trust_mok_keys())
-			trust_mok = true;
+		trust_mok = true;
 	}
 
 	return trust_mok;