mok: remove MokListTrusted from PCR 7

MokListTrusted was added by mistake to PCR 7 in 4e51340. The value of MokListTrusted does not alter the behavior of secure boot so, as per https://trustedcomputinggroup.org/wp-content/uploads/TCG_PCClient_PFP_r1p05_v23_pub.pdf#page=36 (section 3.3.4 PCR usage) so it should not be factored in the value of PCR 7. See: rhboot#423 rhboot@4e51340 Fixes rhboot#484 Fixes rhboot#492 Signed-off-by: Arthur Gautier <[email protected]>
endlessm · Nov 14, 2022 · aa1b289 · aa1b289
1 parent 5169769
commit aa1b289
Showing 1 changed file with 0 additions and 1 deletion.
diff --git a/mok.c b/mok.c
@@ -178,7 +178,6 @@ struct mok_state_variable mok_state_variable_data[] = {
 		     EFI_VARIABLE_NON_VOLATILE,
 	 .no_attr = EFI_VARIABLE_RUNTIME_ACCESS,
 	 .flags = MOK_MIRROR_DELETE_FIRST |
-		  MOK_VARIABLE_MEASURE |
 		  MOK_VARIABLE_INVERSE |
 		  MOK_VARIABLE_LOG,
 	 .pcr = 14,