secboot/secboot_tpm.go: allow user mode on core

valentindavid · valentindavid · commit 681439e52333 · 2026-04-30T14:27:03.000+02:00
diff --git a/secboot/secboot_sb_test.go b/secboot/secboot_sb_test.go
@@ -1654,6 +1654,7 @@ func (s *secbootSuite) TestResealKeysWithTPM(c *C) {
 			// add options for legacy PCR configuration
 			expectedOptions = append(
 				expectedOptions,
+				sb_efi.WithAllowSecureBootUserMode(),
 				sb_efi.WithSecureBootPolicyProfile(),
 				sb_efi.WithBootManagerCodeProfile(),
 			)
diff --git a/secboot/secboot_tpm.go b/secboot/secboot_tpm.go
@@ -925,6 +925,7 @@ func buildPCRProtectionProfileLegacy(modelParams []*SealKeyModelParams, allowIns
 
 		var options []sb_efi.PCRProfileOption
 		options = append(options,
+			sb_efi.WithAllowSecureBootUserMode(),
 			sb_efi.WithSecureBootPolicyProfile(),
 			sb_efi.WithBootManagerCodeProfile(),
 			sb_efi.WithSignatureDBUpdates(updateDB...),

Original file line number	Diff line number	Diff line change
`@@ -1654,6 +1654,7 @@ func (s secbootSuite) TestResealKeysWithTPM(c C) {`
`1654`	`1654`	`// add options for legacy PCR configuration`
`1655`	`1655`	`expectedOptions = append(`
`1656`	`1656`	`expectedOptions,`
	`1657`	`+ sb_efi.WithAllowSecureBootUserMode(),`
`1657`	`1658`	`sb_efi.WithSecureBootPolicyProfile(),`
`1658`	`1659`	`sb_efi.WithBootManagerCodeProfile(),`
`1659`	`1660`	`)`