efi_loader: don't load signature database from file
The UEFI specification requires that the signature database may only be
stored in tamper-resistant storage. So these variable may not be read
from an unsigned file.
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
diff --git a/include/efi_variable.h b/include/efi_variable.h
index 4623a64..2d97655 100644
--- a/include/efi_variable.h
+++ b/include/efi_variable.h
@@ -161,10 +161,13 @@
/**
* efi_var_restore() - restore EFI variables from buffer
*
+ * Only if @safe is set secure boot related variables will be restored.
+ *
* @buf: buffer
+ * @safe: restoring from tamper-resistant storage
* Return: status code
*/
-efi_status_t efi_var_restore(struct efi_var_file *buf);
+efi_status_t efi_var_restore(struct efi_var_file *buf, bool safe);
/**
* efi_var_from_file() - read variables from file