[PATCH v1 11/14] efi: loader: file: expose no filesystem when signed images are forced

[Johannes Schneider]

systemd-stub packs systemd credentials (*.cred) and system and
configuration extensions (*.raw) from the directory of a UKI into its
initrd, and none of them are signed or go through LoadImage(). With
signed images forced, anyone able to write next to a UKI booted from a
filesystem could pass credentials to the booted system, such as a root
password.

With signed images forced, let OpenVolume() report EFI_UNSUPPORTED for
every volume, the answer for "no filesystem here". This also keeps
LoadImage() from loading images by file device path.

Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Johannes Schneider <johannes.schneider at leica-geosystems.com>
---
 efi/loader/protocols/file.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/efi/loader/protocols/file.c b/efi/loader/protocols/file.c
index bfcf14f0e0..11b9e9e6f2 100644
--- a/efi/loader/protocols/file.c
+++ b/efi/loader/protocols/file.c
@@ -32,6 +32,7 @@
 #include <fs.h>
 #include <linux/sprintf.h>
 #include <xfuncs.h>
+#include <bootm.h>
 
 #define MAX_UTF8_PER_UTF16 3
 
@@ -1014,6 +1015,9 @@ efi_open_volume(struct efi_simple_file_system_protocol *this,
 
 	EFI_ENTRY("%p, %p", this, root);
 
+	if (IS_ENABLED(CONFIG_BOOTM) && bootm_signed_images_are_forced())
+		return EFI_EXIT(EFI_UNSUPPORTED);
+
 	/* No filesystem on the volume is EFI_UNSUPPORTED, not a device error */
 	if (!cdev_get_mount_path(fs->cdev)) {
 		char *devpath = basprintf("/dev/%s", cdev_name(fs->cdev));
-- 
2.43.0