morgan/systemd
1
0
Fork 0
mirror of https://github.com/morgan9e/systemd synced 2026-04-14 00:14:32 +09:00
Code Issues Packages Projects Releases Wiki Activity

man: Clarify secure-boot-enroll defaults

Browse Source 
Clarify in the docs that `if-safe` is the default by noting
that in the text for it, but also moving it to the first mentioned
option.

Make explicit in `man systemd-boot` that the `secure-boot-enroll`
option is specified in the `loader.conf`

Update an outdated comment in boot.c around the same.

Signed-off-by: Colin Walters <walters@verbum.org>
This commit is contained in:
Colin Walters
2025-12-04 14:00:16 -05:00
committed by Zbigniew Jędrzejewski-Szmek
parent eb98ddd8b8
commit 3c85d99c79
3 changed files with 11 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
man/loader.conf.xml
View File

@@ -293,8 +293,10 @@
<para>Controls enrollment of secure boot keys found on the ESP if the system is in setup mode: <para>Controls enrollment of secure boot keys found on the ESP if the system is in setup mode:
<variablelist> <variablelist>
<varlistentry> <varlistentry>
<term><option>off</option></term> <term><option>if-safe</option></term>
<listitem><para>No action is taken.</para> <listitem><para>This is the default. Same behavior as <option>manual</option>, but will try to automatically
enroll the key named <literal>auto</literal> if it is considered to be safe. Currently, this is only
the case if the system is running inside a virtual machine.</para>
<xi:include href="version-info.xml" xpointer="v253"/></listitem> <xi:include href="version-info.xml" xpointer="v253"/></listitem>
</varlistentry> </varlistentry>
@@ -308,10 +310,8 @@
</varlistentry> </varlistentry>
<varlistentry> <varlistentry>
<term><option>if-safe</option></term> <term><option>off</option></term>
<listitem><para>Same behavior as <option>manual</option>, but will try to automatically <listitem><para>No action is taken.</para>
enroll the key <literal>auto</literal> if it is considered to be safe. Currently, this is only
the case if the system is running inside a virtual machine.</para>
<xi:include href="version-info.xml" xpointer="v253"/></listitem> <xi:include href="version-info.xml" xpointer="v253"/></listitem>
</varlistentry> </varlistentry>

5
man/systemd-boot.xml
View File

@@ -392,8 +392,9 @@
<para>Enrollment of Secure Boot variables can be performed manually or automatically if files are available <para>Enrollment of Secure Boot variables can be performed manually or automatically if files are available
under <filename>/loader/keys/<replaceable>NAME</replaceable>/{db,dbx,KEK,PK}.auth</filename>, <replaceable>NAME</replaceable> under <filename>/loader/keys/<replaceable>NAME</replaceable>/{db,dbx,KEK,PK}.auth</filename>, <replaceable>NAME</replaceable>
being the display name for the set of variables in the menu. If one of the sets is named <filename>auto</filename> being the display name for the set of variables in the menu. If one of the sets is named <filename>auto</filename>
then it might be enrolled automatically depending on whether <literal>secure-boot-enroll</literal> is set then it might be enrolled automatically depending on the execution environment and the value of the <literal>secure-boot-enroll</literal> option.
to force or not.</para> See
<citerefentry><refentrytitle>loader.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>.</para>
</refsect1> </refsect1>
<refsect1> <refsect1>

5
src/boot/boot.c
View File

@@ -2997,9 +2997,8 @@ static void config_load_all_entries(
config_add_system_entries(config); config_add_system_entries(config);
/* Find secure boot signing keys and autoload them if configured. Otherwise, create menu entries so /* Using the rules defined by the `secure-boot-enroll` variable, find secure boot signing keys
* that the user can load them manually. If the secure-boot-enroll variable is set to no (the * and perform operations like autoloading them or create menu entries if configured. */
* default), we do not even search for keys on the ESP */
(void) secure_boot_discover_keys(config, root_dir); (void) secure_boot_discover_keys(config, root_dir);
if (config->n_entries == 0) if (config->n_entries == 0)