systemd-boot: Allow key enroll in AuditMode

Since AuditMode automatically switches SetupMode on, it should be
authorized to enroll SecureBoot keys.

Signed-off-by: Nicolas Bouchinet <nicolas.bouchinet@ssi.gouv.fr>

diff --git a/src/boot/efi/boot.c b/src/boot/efi/boot.c
index b4decc152d0369451ed1c7e7759abdab7de115c8..79de121f0d2da51fd4a48257e5eb8a19de16f7ae 100644 (file)
--- a/src/boot/efi/boot.c
+++ b/src/boot/efi/boot.c
@@ -2480,7 +2480,7 @@ static EFI_STATUS secure_boot_discover_keys(Config *config, EFI_FILE *root_dir)
         EFI_STATUS err;
         _cleanup_(file_closep) EFI_FILE *keys_basedir = NULL;
 
-        if (secure_boot_mode() != SECURE_BOOT_SETUP)
+        if (!IN_SET(secure_boot_mode(), SECURE_BOOT_SETUP, SECURE_BOOT_AUDIT))
                 return EFI_SUCCESS;
 
         /* the lack of a 'keys' directory is not fatal and is silently ignored */