condition: add new conditon ConditionSecurity=uefi-secureboot

We have the detector call for this anyway, and it's useful for
conditioning out dbxtool.service, hence let's add this tiny new option.

diff --git a/man/systemd.unit.xml b/man/systemd.unit.xml
index 92c0f6297a900fe5219722f398174cbd0a4101f1..7605c4337589ab4108d12fa376eb49d6fc2ad056 100644 (file)
--- a/man/systemd.unit.xml
+++ b/man/systemd.unit.xml
@@ -1107,15 +1107,13 @@
         kernels into older versions provided by distributions. Hence, this check is inherently unportable and should
         not be used for units which may be used on different distributions.</para>
 
-        <para><varname>ConditionSecurity=</varname> may be used to
-        check whether the given security module is enabled on the
+        <para><varname>ConditionSecurity=</varname> may be used to check
+        whether the given security technology is enabled on the
         system. Currently, the recognized values are
-        <varname>selinux</varname>,
-        <varname>apparmor</varname>,
-        <varname>tomoyo</varname>,
-        <varname>ima</varname>,
-        <varname>smack</varname> and
-        <varname>audit</varname>. The test may be negated by
+        <varname>selinux</varname>, <varname>apparmor</varname>,
+        <varname>tomoyo</varname>, <varname>ima</varname>,
+        <varname>smack</varname>, <varname>audit</varname> and
+        <varname>uefi-secureboot</varname>. The test may be negated by
         prepending an exclamation mark.</para>
 
         <para><varname>ConditionCapability=</varname> may be used to

diff --git a/src/shared/condition.c b/src/shared/condition.c
index 525cc94936f07a5b334993cf2c51e275876b8707..2969a89b4e31002c815c47586ed533bc3a5a6def 100644 (file)
--- a/src/shared/condition.c
+++ b/src/shared/condition.c
@@ -21,6 +21,7 @@
 #include "cap-list.h"
 #include "cgroup-util.h"
 #include "condition.h"
+#include "efivars.h"
 #include "extract-word.h"
 #include "fd-util.h"
 #include "fileio.h"
@@ -376,6 +377,8 @@ static int condition_test_security(Condition *c) {
                 return use_ima();
         if (streq(c->parameter, "tomoyo"))
                 return mac_tomoyo_use();
+        if (streq(c->parameter, "uefi-secureboot"))
+                return is_efi_secure_boot();
 
         return false;
 }