efi-loader: move $SYSTEMD_FORCE_MEASURE override to efi_measured_os()

Follow-up for cd911bec6eec21a2cc775c98bf599ea38cb1fa1f

The (debug) envvar should have highest priority, hence move it
to the new entrypoint function and give it precedence over
systemd.tpm2_measured_os=.

diff --git a/src/shared/efi-loader.c b/src/shared/efi-loader.c
index 73d6960297fcaf79766b7c2a3e0f3e0080ac5d01..da0a3a57b58cf8a387cec5757f4cad39280a605b 100644 (file)
--- a/src/shared/efi-loader.c
+++ b/src/shared/efi-loader.c
@@ -281,13 +281,6 @@ int efi_measured_uki(int log_level) {
          * being used, but it measured things into a different PCR than we are configured for in
          * userspace. (i.e. we expect PCR 11 being used for this by both sd-stub and us) */
 
-        r = secure_getenv_bool("SYSTEMD_FORCE_MEASURE"); /* Give user a chance to override the variable test,
-                                                          * for debugging purposes */
-        if (r >= 0)
-                return (cached = r);
-        if (r != -ENXIO)
-                log_debug_errno(r, "Failed to parse $SYSTEMD_FORCE_MEASURE, ignoring: %m");
-
         if (!efi_has_tpm2())
                 return (cached = 0);
 
@@ -323,6 +316,13 @@ int efi_measured_os(int log_level) {
         if (cached >= 0)
                 return cached;
 
+        r = secure_getenv_bool("SYSTEMD_FORCE_MEASURE"); /* Give user a chance to override the variable test,
+                                                          * for debugging purposes */
+        if (r >= 0)
+                return (cached = r);
+        if (r != -ENXIO)
+                log_debug_errno(r, "Failed to parse $SYSTEMD_FORCE_MEASURE, ignoring: %m");
+
         bool b;
         r = proc_cmdline_get_bool("systemd.tpm2_measured_os", /* flags= */ 0, &b);
         if (r > 0)