From 04f6566568e0618088c7496a7e89da8d949b3c72 Mon Sep 17 00:00:00 2001
From: Nicolas Bouchinet <nicolas.bouchinet@ssi.gouv.fr>
Date: Fri, 3 May 2024 11:42:09 +0200
Subject: [PATCH 0591/1160] systemd-boot: Allow key enroll in AuditMode

Since AuditMode automatically switches SetupMode on, it should be
authorized to enroll SecureBoot keys.

Signed-off-by: Nicolas Bouchinet <nicolas.bouchinet@ssi.gouv.fr>
(cherry picked from commit a23a59b324a022a0b38b5f35d01ee1b2b4edf694)
---
 src/boot/efi/boot.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/boot/efi/boot.c b/src/boot/efi/boot.c
index a3d5607c1a..e0ffc3b62d 100644
--- a/src/boot/efi/boot.c
+++ b/src/boot/efi/boot.c
@@ -2466,7 +2466,7 @@ static EFI_STATUS secure_boot_discover_keys(Config *config, EFI_FILE *root_dir)
         EFI_STATUS err;
         _cleanup_(file_closep) EFI_FILE *keys_basedir = NULL;
 
-        if (secure_boot_mode() != SECURE_BOOT_SETUP)
+        if (!IN_SET(secure_boot_mode(), SECURE_BOOT_SETUP, SECURE_BOOT_AUDIT))
                 return EFI_SUCCESS;
 
         /* the lack of a 'keys' directory is not fatal and is silently ignored */
-- 
2.33.0