From: Luca Boccassi <bluca@debian.org>
Date: Fri, 7 Feb 2025 09:43:47 +0000 (+0100)
Subject: trust machine keyring (MoK) by default
X-Git-Tag: archive/raspbian/6.1.128-1+rpi1^2~50
X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=865486fdd772eacfe13f5293078bbc57902cb753;p=linux.git

trust machine keyring (MoK) by default

Debian always trusted keys in MoK by default. Upstream made it conditional on
a new EFI variable being set. To keep backward compatibility skip this check.

Gbp-Pq: Topic features/all/db-mok-keyring
Gbp-Pq: Name trust-machine-keyring-by-default.patch
---

diff --git a/security/integrity/platform_certs/machine_keyring.c b/security/integrity/platform_certs/machine_keyring.c
index 7aaed7950b6..416da7b788a 100644
--- a/security/integrity/platform_certs/machine_keyring.c
+++ b/security/integrity/platform_certs/machine_keyring.c
@@ -69,8 +69,7 @@ bool __init trust_moklist(void)
 	if (!initialized) {
 		initialized = true;
 
-		if (uefi_check_trust_mok_keys())
-			trust_mok = true;
+		trust_mok = true;
 	}
 
 	return trust_mok;