lib/security: hard_lockdown flag to stop runtime disable of signed boot

[petitboot] / ui / ncurses / nc-boot-editor.c

diff --git a/ui/ncurses/nc-boot-editor.c b/ui/ncurses/nc-boot-editor.c
index f302c52ce50672a1ae5ff912a2aa7ff0b8a66b97..3f7c5e515b36bf72dfdbfa255e1eb8c88af54ff8 100644 (file)
--- a/ui/ncurses/nc-boot-editor.c
+++ b/ui/ncurses/nc-boot-editor.c
@@ -636,10 +636,12 @@ struct boot_editor *boot_editor_init(struct cui *cui,
        if (!boot_editor)
                return NULL;
 
-#if defined(HAVE_LIBGPGME)
+#if defined(SIGNED_BOOT)
+#if !defined(HARD_LOCKDOWN)
        if (access(LOCKDOWN_FILE, F_OK) == -1)
                boot_editor->use_signature_files = false;
        else
+#endif
                boot_editor->use_signature_files = true;
 #else
        boot_editor->use_signature_files = false;