From f881b4d129602a49e3403043fc27550a74453234 Mon Sep 17 00:00:00 2001 From: Gerd Hoffmann Date: Thu, 22 Feb 2024 11:13:58 +0100 Subject: OvmfPkg: only add shell to FV in case secure boot is disabled The EFI Shell allows to bypass secure boot, do not allow to include the shell in the firmware images of secure boot enabled builds. This prevents misconfigured downstream builds. Ref: https://bugs.launchpad.net/ubuntu/+source/edk2/+bug/2040137 Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=4641 Signed-off-by: Gerd Hoffmann Reviewed-by: Laszlo Ersek Acked-by: Jiewen Yao Message-Id: <20240222101358.67818-13-kraxel@redhat.com> --- OvmfPkg/Include/Fdf/ShellDxe.fdf.inc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/OvmfPkg/Include/Fdf/ShellDxe.fdf.inc b/OvmfPkg/Include/Fdf/ShellDxe.fdf.inc index 3081ac4178..38f69747b0 100644 --- a/OvmfPkg/Include/Fdf/ShellDxe.fdf.inc +++ b/OvmfPkg/Include/Fdf/ShellDxe.fdf.inc @@ -2,7 +2,7 @@ # SPDX-License-Identifier: BSD-2-Clause-Patent ## -!if $(BUILD_SHELL) == TRUE +!if $(BUILD_SHELL) == TRUE && $(SECURE_BOOT_ENABLE) == FALSE !if $(TOOL_CHAIN_TAG) != "XCODE5" !if $(NETWORK_ENABLE) == TRUE -- cgit v1.2.3