From b078ef274887a4cc0da64fd6668800d1e24a2871 Mon Sep 17 00:00:00 2001 From: Jan Setje-Eilers Date: Tue, 16 May 2023 14:31:13 -0700 Subject: [PATCH] Always clear SbatLevel when Secure Boot is disabled Unless an explict sbat policy is specified, always delete SbatLevel when secure boot is disabled. Signed-off-by: Jan Setje-Eilers --- sbat.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/sbat.c b/sbat.c index a08c5b2..42a3346 100644 --- a/sbat.c +++ b/sbat.c @@ -423,7 +423,12 @@ set_sbat_uefi_variable(void) &attributes); if (EFI_ERROR(efi_status)) { dprint("Default sbat policy: previous\n"); - sbat_var = sbat_var_previous; + if (secure_mode()) { + sbat_var = sbat_var_previous; + } else { + reset_sbat = true; + sbat_var = SBAT_VAR_ORIGINAL; + } } else { switch (*sbat_policy) { case SBAT_POLICY_LATEST: @@ -449,7 +454,12 @@ set_sbat_uefi_variable(void) default: console_error(L"SBAT policy state %llu is invalid", EFI_INVALID_PARAMETER); - sbat_var = sbat_var_previous; + if (secure_mode()) { + sbat_var = sbat_var_previous; + } else { + reset_sbat = true; + sbat_var = SBAT_VAR_ORIGINAL; + } clear_sbat_policy(); break; } -- 2.33.0