On Sep 16, 2021, at 4:19 PM, Peter Jones [off-list ref] wrote:

On Tue, Sep 14, 2021 at 05:14:15PM -0400, Eric Snowberg wrote:

quoted

+/*
+ * Try to load the MokListTrustedRT UEFI variable to see if we should trust
+ * the mok keys within the kernel. It is not an error if this variable
+ * does not exist.  If it does not exist, mok keys should not be trusted
+ * within the machine keyring.
+ */
+static __init bool uefi_check_trust_mok_keys(void)
+{
+	efi_status_t status;
+	unsigned int mtrust = 0;
+	unsigned long size = sizeof(mtrust);
+	efi_guid_t guid = EFI_SHIM_LOCK_GUID;
+	u32 attr;
+
+	status = efi.get_variable(L"MokListTrustedRT", &guid, &attr, &size, &mtrust);

This should use efi_mokvar_entry_find("MokListTrustedRT") instead,
similar to how load_moklist_certs() does.  It's a *much* more reliable
mechanism.  We don't even need to fall back to checking for the
variable, as any version of shim that populates this supports the config
table method.

I’ll change this in v7, thanks.