[PATCH] efi_loader: allow disabling EFI secure boot in User Mode

[Paulo Alcantara]

Introduce a new config option CONFIG_EFI_SECURE_BOOT_VAR_DISABLE to
allow disabling EFI secure boot when the platform is operating in User
Mode and there is an NV+BS EFI variable called "SecureBootDisable".
Otherwise, keep it enabled by default.

Signed-off-by: Paulo Alcantara (SUSE) <pc at cjr.nz>
---
 lib/efi_loader/Kconfig          | 13 +++++++++
 lib/efi_loader/efi_var_common.c | 48 ++++++++++++++++++++++++++++++++-
 2 files changed, 60 insertions(+), 1 deletion(-)

diff --git a/lib/efi_loader/Kconfig b/lib/efi_loader/Kconfig
index 29ea14b2ee2a..d453905c7666 100644
--- a/lib/efi_loader/Kconfig
+++ b/lib/efi_loader/Kconfig
@@ -224,5 +224,18 @@ config EFI_SECURE_BOOT
 	  Once SecureBoot mode is enforced, any EFI binary can run only if
 	  it is signed with a trusted key. To do that, you need to install,
 	  at least, PK, KEK and db.
+	  Note that SecureBoot mode may no longer be enforced when
+	  EFI_SECURE_BOOT_VAR_DISABLE option is enabled.
+
+config EFI_SECURE_BOOT_VAR_DISABLE
+	bool "Permit to disable EFI secure boot when in User Mode"
+	depends on EFI_SECURE_BOOT
+	default n
+	help
+	  Select this option to allow disabling EFI secure boot when
+	  the platform is operating in User Mode (e.g. PK is enrolled)
+	  and there is an NV+BS EFI variable called
+	  "SecureBootDisable". A platform reset is also required to
+	  actually disable it.
 
 endif
diff --git a/lib/efi_loader/efi_var_common.c b/lib/efi_loader/efi_var_common.c
index 1c7459266a38..89aa944180a4 100644
--- a/lib/efi_loader/efi_var_common.c
+++ b/lib/efi_loader/efi_var_common.c
@@ -241,6 +241,48 @@ err:
 	return ret;
 }
 
+
+#ifdef CONFIG_EFI_SECURE_BOOT_VAR_DISABLE
+/**
+ * efi_secure_boot_in_user_mode - check if secure boot enabled in User Mode
+ *
+ * @enabled: true if enabled, false if disabled
+ *
+ * Return: status code
+ */
+static efi_status_t efi_secure_boot_in_user_mode(u8 *enabled)
+{
+	efi_status_t ret;
+	efi_uintn_t size = 0;
+	u32 attributes;
+	u32 mask = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS;
+
+	ret = efi_get_variable_int(L"SecureBootDisable",
+				   &efi_global_variable_guid,
+				   &attributes, &size, NULL, NULL);
+	if (ret == EFI_BUFFER_TOO_SMALL) {
+		if (attributes ^ mask) {
+			log_err("Unable to disable secure boot. Required attributes for SecureBootDisable variable: NV+BS\n");
+			*enabled = 1;
+		} else {
+			EFI_PRINT("Disabling secure boot due to existing SecureBootDisable variable\n");
+			*enabled = 0;
+		}
+		ret = EFI_SUCCESS;
+	} else if (ret == EFI_NOT_FOUND) {
+		*enabled = 1;
+		ret = EFI_SUCCESS;
+	}
+	return ret;
+}
+#else
+static efi_status_t efi_secure_boot_in_user_mode(u8 *enabled)
+{
+	*enabled = 1;
+	return EFI_SUCCESS;
+}
+#endif
+
 /**
  * efi_transfer_secure_state - handle a secure boot state transition
  * @mode:	new state
@@ -274,7 +316,11 @@ static efi_status_t efi_transfer_secure_state(enum efi_secure_mode mode)
 		if (ret != EFI_SUCCESS)
 			goto err;
 	} else if (mode == EFI_MODE_USER) {
-		ret = efi_set_secure_state(1, 0, 0, 0);
+		u8 secure_boot;
+		ret = efi_secure_boot_in_user_mode(&secure_boot);
+		if (ret != EFI_SUCCESS)
+			goto err;
+		ret = efi_set_secure_state(secure_boot, 0, 0, 0);
 		if (ret != EFI_SUCCESS)
 			goto err;
 	} else if (mode == EFI_MODE_SETUP) {
-- 
2.29.2