lib/security: hard_lockdown flag to stop runtime disable of signed boot

[petitboot] / ui / ncurses / nc-cui.c

diff --git a/ui/ncurses/nc-cui.c b/ui/ncurses/nc-cui.c
index 20a90483cd07accc318546d9fc26aab48c9f72dc..8a3f97dc9b593f58bd14d40989b6d389eacf2365 100644 (file)
--- a/ui/ncurses/nc-cui.c
+++ b/ui/ncurses/nc-cui.c
@@ -61,10 +61,14 @@ static void cui_cancel_autoboot_on_exit(struct cui *cui);
 
 static bool lockdown_active(void)
 {
+#if defined(SIGNED_BOOT) && defined(HARD_LOCKDOWN)
+       return true;
+#else
        bool lockdown = false;
        if (access(LOCKDOWN_FILE, F_OK) != -1)
                lockdown = true;
        return lockdown;
+#endif
 }
 
 static void cui_start(void)