Re: [isar-cip-core][PATCH 2/7] cip-initramfs-functions: Add secure_boot_enabled helper

[Jan Kiszka <jan.kiszka@siemens.com>]

On 26.08.26 09:51, Heinisch, Alexander (FT RPD CED SES-AT) wrote:
> 
> 
> Am 26.08.2026 um 07:41 schrieb Jan Kiszka:
>> From: Jan Kiszka <jan.kiszka@siemens.com>
>>
>> Will allow initramfs hooks to determine whether UEFI secure boot is
>> enabled. The user is responsible for deploying cmp and mountpoint
>> binaries into the initramfs.
>>
>> Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
>> ---
>>   .../files/cip-initramfs-functions                | 16 ++++++++++++++++
>>   1 file changed, 16 insertions(+)
>>
>> diff --git a/recipes-initramfs/initramfs-cip-functions/files/cip-
>> initramfs-functions b/recipes-initramfs/initramfs-cip-functions/files/
>> cip-initramfs-functions
>> index a4c1fed6..f14956d5 100644
>> --- a/recipes-initramfs/initramfs-cip-functions/files/cip-initramfs-
>> functions
>> +++ b/recipes-initramfs/initramfs-cip-functions/files/cip-initramfs-
>> functions
>> @@ -68,3 +68,19 @@ scan_for_partitions() {
>>       fi
>>       return 1
>>   }
>> +
>> +# check if system was securely booted via UEFI
>> +secure_boot_enabled() {
>> +    efivars=/sys/firmware/efi/efivars
>> +    if ! mountpoint -q $efivars; then
>> +        mount -t efivarfs none $efivars
>> +    fi
>> +
>> +    secure_boot="$efivars/SecureBoot-8be4df61-93ca-11d2-
>> aa0d-00e098032b8c"
>> +    setup_mode="$efivars/SetupMode-8be4df61-93ca-11d2-aa0d-00e098032b8c"
>> +    if printf '\001' | cmp -s -i 4:0 $secure_boot &&
>> +       printf '\000' | cmp -s -i 4:0 $setup_mode; then
> What about audit mode?

You mean, I should check for != 1 instead? Seems that this is what the
kernel does as well...

Jan

-- 
Siemens AG, Foundational Technologies
Linux Expert Center