AS_IF([test "x$VERIFY_DIGEST" = x], [VERIFY_DIGEST="sha256"])
AC_DEFINE_UNQUOTED(VERIFY_DIGEST, "$VERIFY_DIGEST", [openssl verify dgst])
+AC_ARG_ENABLE([hard-lockdown],
+ [AS_HELP_STRING([--enable-hard-lockdown],
+ [if signed boot configured, the absence of the
+ LOCKDOWN_FILE does not disable signed boot at
+ runtime @<:@default=no@:>@])],
+ [AC_DEFINE(HARD_LOCKDOWN, 1, [Enable hard lockdown])],
+ [])
+
AC_ARG_ENABLE(
[busybox],
[AS_HELP_STRING(
/* assume most restrictive lockdown type */
int ret = PB_LOCKDOWN_SIGN;
+#if !defined(HARD_LOCKDOWN)
if (access(LOCKDOWN_FILE, F_OK) == -1)
return PB_LOCKDOWN_NONE;
+#endif
/* determine lockdown type */
FILE *authorized_signatures_handle = NULL;
int ret = PB_LOCKDOWN_SIGN;
PKCS12 *p12 = NULL;
+#if !defined(HARD_LOCKDOWN)
if (access(LOCKDOWN_FILE, F_OK) == -1)
return PB_LOCKDOWN_NONE;
+#endif
/* determine lockdown type */
fclose(authorized_signatures_handle);
}
- return ret;
+ return ret;
}
return NULL;
#if defined(SIGNED_BOOT)
+#if !defined(HARD_LOCKDOWN)
if (access(LOCKDOWN_FILE, F_OK) == -1)
boot_editor->use_signature_files = false;
else
+#endif
boot_editor->use_signature_files = true;
#else
boot_editor->use_signature_files = false;
static bool lockdown_active(void)
{
+#if defined(SIGNED_BOOT) && defined(HARD_LOCKDOWN)
+ return true;
+#else
bool lockdown = false;
if (access(LOCKDOWN_FILE, F_OK) != -1)
lockdown = true;
return lockdown;
+#endif
}
static void cui_start(void)