Better return codes

Introduce --is-sb-enabled parameter and better return codes. Also show
help on unsupported systems.

Resolves: #RHEL-90836
Resolves: #RHEL-90839
Signed-off-by: Leo Sandoval <lsandova@redhat.com>

0001-Show-usage-instead-of-aborting-on-bad-flags.patch

@@ -1,31 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Robbie Harwood <rharwood@redhat.com>
-Date: Tue, 17 May 2022 11:23:28 -0400
-Subject: [PATCH] Show usage instead of aborting on bad flags
-
-Aborting here just confuses users and is sufficiently unexpected to
-cause the filing of bugs.
-
-Related: https://bugzilla.redhat.com/show_bug.cgi?id=2087066
-Signed-off-by: Robbie Harwood <rharwood@redhat.com>
-(cherry picked from commit 82694cb1ce3b29c3705c25ae4cea3d07fe57b558)
----
- src/mokutil.c | 3 +--
- 1 file changed, 1 insertion(+), 2 deletions(-)
-
-diff --git a/src/mokutil.c b/src/mokutil.c
-index 5d725c9..e8228af 100644
---- a/src/mokutil.c
-+++ b/src/mokutil.c
-@@ -2087,10 +2087,9 @@ main (int argc, char *argv[])
- 			goto out;
- 		case 'h':
- 		case '?':
-+		default:
- 			command |= HELP;
- 			break;
--		default:
--			abort ();
- 		}
- 	}
- 

0001-mokutil.c-show-help-if-no-args-or-help-even-on-unsup.patch

@@ -0,0 +1,45 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Leonardo Sandoval <lsandova@redhat.com>
+Date: Fri, 25 Oct 2024 13:53:05 -0600
+Subject: [PATCH] mokutil.c: show help if no args or --help even on unsupported
+ system
+
+Signed-off-by: Leo Sandoval <lsandova@redhat.com>
+---
+ src/mokutil.c | 19 +++++++++++++++----
+ 1 file changed, 15 insertions(+), 4 deletions(-)
+
+diff --git a/src/mokutil.c b/src/mokutil.c
+index cb06be2..2da211d 100644
+--- a/src/mokutil.c
++++ b/src/mokutil.c
+@@ -2156,14 +2156,25 @@ main (int argc, char *argv[])
+ 	if (pw_hash_file && use_root_pw)
+ 		command |= HELP;
+ 
+-	if (!(command & HELP) && !efi_variables_supported ()) {
+-		fprintf (stderr, "EFI variables are not supported on this system\n");
+-		exit (1);
+-	}
+ 
+ 	if (db_name != MOK_LIST_RT && !(command & ~MOKX))
+ 		command |= LIST_ENROLLED;
+ 
++	/* no matter if mokutil is supported (EFI) or not (BIOS) in the system, print
++	   the help menu if no command line arguments provided or explicit help
++	   requested */
++	if (!command || (command & HELP)) {
++		print_help ();
++		ret = 0;
++		goto out;
++	}
++
++	/* check if mock is supported on the system */
++	if (!efi_variables_supported ()) {
++		fprintf (stderr, "EFI variables are not supported on this system\n");
++		exit (1);
++	}
++
+ 	sb_check = !(command & HELP || command & TEST_KEY ||
+ 		     command & VERBOSITY || command & TIMEOUT ||
+ 		     command & FB_VERBOSITY || command & FB_NOREBOOT);

0002-mokutil-bugfix-del-unused-opt-s.patch

@@ -1,26 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: gaoyusong <gaoyusong2@huawei.com>
-Date: Mon, 30 May 2022 17:54:47 +0800
-Subject: [PATCH] mokutil bugfix: del unused opt "-s"
-
-The -s option can cause unexcepted result.
-
-Signed-off-by: gaoyusong <gaoyusong2@huawei.com>
-(cherry picked from commit 04791c29e198b18808bca519267e31c8d3786a08)
----
- src/mokutil.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/src/mokutil.c b/src/mokutil.c
-index e8228af..6982ade 100644
---- a/src/mokutil.c
-+++ b/src/mokutil.c
-@@ -1851,7 +1851,7 @@ main (int argc, char *argv[])
- 		};
- 
- 		int option_index = 0;
--		c = getopt_long (argc, argv, "cd:f:g::hi:lmpst:xDNPXv",
-+		c = getopt_long (argc, argv, "cd:f:g::hi:lmpt:xDNPXv",
- 				 long_options, &option_index);
- 
- 		if (c == -1)

0002-mokutil-fix-a-typo-mock.patch

@@ -0,0 +1,27 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Gary Lin <glin@suse.com>
+Date: Mon, 28 Apr 2025 18:18:00 +0800
+Subject: [PATCH] mokutil: fix a typo 'mock'
+
+'mock' is the typo of 'MOK'. Since efi_variables_supported() checks the
+EFI variable support of the system, correct the comment to match the
+code.
+
+Signed-off-by: Gary Lin <glin@suse.com>
+---
+ src/mokutil.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/mokutil.c b/src/mokutil.c
+index 2da211d..988b060 100644
+--- a/src/mokutil.c
++++ b/src/mokutil.c
+@@ -2169,7 +2169,7 @@ main (int argc, char *argv[])
+ 		goto out;
+ 	}
+ 
+-	/* check if mock is supported on the system */
++	/* check if EFI variable is supported on the system */
+ 	if (!efi_variables_supported ()) {
+ 		fprintf (stderr, "EFI variables are not supported on this system\n");
+ 		exit (1);

0003-Fix-leak-of-list-in-delete_data_from_req_var.patch

@@ -1,28 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Robbie Harwood <rharwood@redhat.com>
-Date: Thu, 2 Jun 2022 12:56:31 -0400
-Subject: [PATCH] Fix leak of list in delete_data_from_req_var()
-
-Signed-off-by: Robbie Harwood <rharwood@redhat.com>
-(cherry picked from commit d978c18f61b877afaab45a82d260b525423b8248)
----
- src/util.c | 6 ++++--
- 1 file changed, 4 insertions(+), 2 deletions(-)
-
-diff --git a/src/util.c b/src/util.c
-index 621869f..6cd0302 100644
---- a/src/util.c
-+++ b/src/util.c
-@@ -295,8 +295,10 @@ delete_data_from_req_var (const MokRequest req, const efi_guid_t *type,
- 	}
- 
- 	/* the key or hash is not in this list */
--	if (start == NULL)
--		return 0;
-+	if (start == NULL) {
-+		ret = 0;
-+		goto done;
-+	}
- 
- 	/* all keys are removed */
- 	if (total == 0) {

0003-mokutil-remove-unused-int_to_b64.patch

@@ -0,0 +1,56 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Nicolas Frayer <nfrayer@redhat.com>
+Date: Wed, 29 Jan 2025 17:37:36 +0100
+Subject: [PATCH] mokutil: remove unused int_to_b64()
+
+static const char b64t[64] triggers compiler warning
+which in turn makes the build fail with
+-Werror=unterminated-string-initialization, so removing
+this string with the the unused int_to_b64() function
+which is the only function using this array.
+
+Signed-off-by: Nicolas Frayer <nfrayer@redhat.com>
+---
+ src/password-crypt.c | 9 ---------
+ src/password-crypt.h | 1 -
+ 2 files changed, 10 deletions(-)
+
+diff --git a/src/password-crypt.c b/src/password-crypt.c
+index db69b88..bdbf784 100644
+--- a/src/password-crypt.c
++++ b/src/password-crypt.c
+@@ -46,9 +46,6 @@
+ #define SHA256_DEFAULT_ROUNDS 5000
+ #define SHA512_DEFAULT_ROUNDS 5000
+ 
+-static const char b64t[64] =
+-"./0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
+-
+ static const char md5_prefix[] = "$1$";
+ 
+ static const char sha256_prefix[] = "$5$";
+@@ -357,12 +354,6 @@ decode_pass (const char *crypt_pass, pw_crypt_t *pw_crypt)
+ 	return -1;
+ }
+ 
+-char
+-int_to_b64 (const int i)
+-{
+-	return b64t[i & 0x3f];
+-}
+-
+ int
+ b64_to_int (const char c)
+ {
+diff --git a/src/password-crypt.h b/src/password-crypt.h
+index 214a65b..999e036 100644
+--- a/src/password-crypt.h
++++ b/src/password-crypt.h
+@@ -68,7 +68,6 @@ uint16_t get_pw_salt_size (const HashMethod method);
+ int get_pw_hash_size (const HashMethod method);
+ const char *get_crypt_prefix (const HashMethod method);
+ int decode_pass (const char *crypt_pass, pw_crypt_t *pw_crypt);
+-char int_to_b64 (const int i);
+ int b64_to_int (const char c);
+ 
+ #endif /* __PASSWORD_CRYPT_H__ */

0004-Fix-leak-of-fd-in-mok_get_variable.patch

@@ -1,70 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Robbie Harwood <rharwood@redhat.com>
-Date: Thu, 2 Jun 2022 13:00:22 -0400
-Subject: [PATCH] Fix leak of fd in mok_get_variable()
-
-On success, it was never closed.  Refactor the code to use a single
-egress path so its closure is clear.
-
-Signed-off-by: Robbie Harwood <rharwood@redhat.com>
-(cherry picked from commit e498f6460ff5aea6a7cd61a33087d03e88a2f52a)
----
- src/util.c | 24 +++++++++++++-----------
- 1 file changed, 13 insertions(+), 11 deletions(-)
-
-diff --git a/src/util.c b/src/util.c
-index 6cd0302..f7fc033 100644
---- a/src/util.c
-+++ b/src/util.c
-@@ -57,22 +57,21 @@ mok_get_variable(const char *name, uint8_t **datap, size_t *data_sizep)
- 		return fd;
- 
- 	rc = fstat(fd, &sb);
--	if (rc < 0) {
--err_close:
--		close(fd);
--		return rc;
--	}
-+	if (rc < 0)
-+		goto done;
- 
- 	if (sb.st_size == 0) {
- 		errno = ENOENT;
- 		rc = -1;
--		goto err_close;
-+		goto done;
- 	}
- 
- 	bufsz = sb.st_size;
- 	buf = calloc(1, bufsz);
--	if (!buf)
--		goto err_close;
-+	if (!buf) {
-+		rc = -1;
-+		goto done;
-+	}
- 
- 	while (pos < bufsz) {
- 		ssz = read(fd, &buf[pos], bufsz - pos);
-@@ -82,15 +81,18 @@ err_close:
- 			    errno == EINTR)
- 				continue;
- 			free(buf);
--			goto err_close;
-+			rc = -1;
-+			goto done;
- 		}
- 
- 		pos += ssz;
- 	}
- 	*datap = buf;
- 	*data_sizep = pos;
--
--	return 0;
-+	rc = 0;
-+done:
-+	close(fd);
-+	return rc;
- }
- 
- MokListNode*

0004-mokutil.c-on-test-key-return-non-zero-if-test-key-is.patch

@@ -0,0 +1,27 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Leo Sandoval <lsandova@redhat.com>
+Date: Thu, 24 Apr 2025 12:49:29 -0600
+Subject: [PATCH] mokutil.c: on --test-key, return non-zero if test key is not
+ enrolled
+
+Aligns with the same behaviour as other common UNIX tools,
+e.g. 'command -v program' returns 0 if program exists, non-zero if not
+
+Signed-off-by: Leo Sandoval <lsandova@redhat.com>
+---
+ src/mokutil.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/mokutil.c b/src/mokutil.c
+index 988b060..e40579b 100644
+--- a/src/mokutil.c
++++ b/src/mokutil.c
+@@ -1567,7 +1567,7 @@ test_key (const MokRequest req, const char *key_file)
+ 
+ 	if (is_valid_request (&efi_guid_x509_cert, key, read_size, req)) {
+ 		printf ("%s is not enrolled\n", key_file);
+-		ret = 0;
++		ret = 1;
+ 	} else {
+ 		print_skip_message (key_file, key, read_size, req);
+ 		ret = 1;

0005-mokutil-introduce-is-sb-enabled-parameter.patch

@@ -0,0 +1,138 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Leo Sandoval <lsandova@redhat.com>
+Date: Fri, 25 Apr 2025 13:07:10 -0600
+Subject: [PATCH] mokutil: introduce --is-sb-enabled parameter
+
+The result would be 0 if SB is enable, 1 otherwise (or -1 in case of
+error). This is a different outcome when using --sb-state, where it
+returns 0 no matter the SB status (or -1 in case of error).
+
+Signed-off-by: Leo Sandoval <lsandova@redhat.com>
+---
+ man/mokutil.1 |  5 +++++
+ src/mokutil.c | 30 ++++++++++++++++++++++++++++--
+ 2 files changed, 33 insertions(+), 2 deletions(-)
+
+diff --git a/man/mokutil.1 b/man/mokutil.1
+index ccb285c..6b30610 100644
+--- a/man/mokutil.1
++++ b/man/mokutil.1
+@@ -40,6 +40,8 @@ mokutil \- utility to manipulate machine owner keys
+ .br
+ \fBmokutil\fR [--sb-state]
+ .br
++\fBmokutil\fR [--is-sb-enabled]
++.br
+ \fBmokutil\fR [--test-key \fIkeyfile\fR | -t \fIkeyfile\fR]
+         ([--mokx | -X] | [--ca-check] | [--ignore-keyring])
+ .br
+@@ -133,6 +135,9 @@ Enable the validation process in shim
+ \fB--sb-state\fR
+ Show SecureBoot State
+ .TP
++\fB--is-sb-enabled\fR
++Indicates if SecureBoot is enabled
++.TP
+ \fB-t, --test-key\fR
+ Test if the key is enrolled or not
+ .TP
+diff --git a/src/mokutil.c b/src/mokutil.c
+index e40579b..918ca06 100644
+--- a/src/mokutil.c
++++ b/src/mokutil.c
+@@ -89,6 +89,7 @@
+ #define UNTRUST_MOK        (1 << 28)
+ #define SET_SBAT           (1 << 29)
+ #define SET_SSP            (1 << 30)
++#define IS_SB_ENABLED      (1 << 31)
+ 
+ #define DEFAULT_CRYPT_METHOD SHA512_BASED
+ #define DEFAULT_SALT_SIZE    SHA512_SALT_MAX
+@@ -129,6 +130,7 @@ print_help ()
+ 	printf ("  --disable-validation\t\t\tDisable signature validation\n");
+ 	printf ("  --enable-validation\t\t\tEnable signature validation\n");
+ 	printf ("  --sb-state\t\t\t\tShow SecureBoot State\n");
++	printf ("  --is-sb-enabled\t\t\tIndicates if SecureBoot is enabled or not\n");
+ 	printf ("  --test-key, -t <der file>\t\tTest if the key is enrolled or not\n");
+ 	printf ("  --reset\t\t\t\tReset MOK list\n");
+ 	printf ("  --generate-hash[=password], -g\tGenerate the password hash\n");
+@@ -1400,7 +1402,7 @@ enable_validation(void)
+ }
+ 
+ static int
+-sb_state ()
++sb_state_internal ()
+ {
+ 	uint8_t *data = NULL;
+ 	size_t data_size;
+@@ -1408,6 +1410,7 @@ sb_state ()
+ 	int32_t secureboot = -1;
+ 	int32_t setupmode = -1;
+ 	int32_t moksbstate = -1;
++	int ret = 0;
+ 
+ 	if (efi_get_variable (efi_guid_global, "SecureBoot", &data, &data_size,
+ 			      &attributes) < 0) {
+@@ -1453,17 +1456,34 @@ sb_state ()
+ 
+ 	if (secureboot == 1 && setupmode == 0) {
+ 		printf ("SecureBoot enabled\n");
++		ret = 0;
+ 		if (moksbstate == 1)
+ 			printf ("SecureBoot validation is disabled in shim\n");
+ 	} else if (secureboot == 0 || setupmode == 1) {
+ 		printf ("SecureBoot disabled\n");
++		ret = 1;
+ 		if (setupmode == 1)
+ 			printf ("Platform is in Setup Mode\n");
+ 	} else {
+ 		printf ("Cannot determine secure boot state.\n");
+ 	}
+ 
+-	return 0;
++	return ret;
++}
++
++static int
++sb_state ()
++{
++	int ret = sb_state_internal ();
++
++	/* in this case, ignore the ret value except on failure */
++	return (ret < 0)? ret: 0;
++}
++
++static int
++is_sb_enabled ()
++{
++	return sb_state_internal ();
+ }
+ 
+ static inline int
+@@ -1855,6 +1875,7 @@ main (int argc, char *argv[])
+ 			{"disable-validation", no_argument,       0, 0  },
+ 			{"enable-validation",  no_argument,       0, 0  },
+ 			{"sb-state",           no_argument,       0, 0  },
++			{"is-sb-enabled",      no_argument,       0, 0  },
+ 			{"test-key",           required_argument, 0, 't'},
+ 			{"reset",              no_argument,       0, 0  },
+ 			{"hash-file",          required_argument, 0, 'f'},
+@@ -1908,6 +1929,8 @@ main (int argc, char *argv[])
+ 				command |= ENABLE_VALIDATION;
+ 			} else if (strcmp (option, "sb-state") == 0) {
+ 				command |= SB_STATE;
++			} else if (strcmp (option, "is-sb-enabled") == 0) {
++				command |= IS_SB_ENABLED;
+ 			} else if (strcmp (option, "reset") == 0) {
+ 				command |= RESET;
+ 			} else if (strcmp (option, "ignore-db") == 0) {
+@@ -2258,6 +2281,9 @@ main (int argc, char *argv[])
+ 		case SB_STATE:
+ 			ret = sb_state ();
+ 			break;
++		case IS_SB_ENABLED:
++			ret = is_sb_enabled ();
++			break;
+ 		case TEST_KEY:
+ 			ret = test_key (ENROLL_MOK, key_file);
+ 			break;

mokutil.patches

@@ -0,0 +1,5 @@
+Patch0001: 0001-mokutil.c-show-help-if-no-args-or-help-even-on-unsup.patch
+Patch0002: 0002-mokutil-fix-a-typo-mock.patch
+Patch0003: 0003-mokutil-remove-unused-int_to_b64.patch
+Patch0004: 0004-mokutil.c-on-test-key-return-non-zero-if-test-key-is.patch
+Patch0005: 0005-mokutil-introduce-is-sb-enabled-parameter.patch

mokutil.spec

@@ -1,6 +1,6 @@
 Name:           mokutil
 Version:        0.7.2
-Release:        1%{?dist}
+Release:        2%{?dist}
 Epoch:          2
 Summary:        Tool to manage UEFI Secure Boot MoK Keys
 License:        GPL-3.0-or-later
@@ -47,6 +47,14 @@ mokutil provides a tool to manage keys for Secure Boot through the MoK
 %{_datadir}/bash-completion/completions/mokutil
 
 %changelog
+* Mon May 12 2025 Leo Sandoval <lsandova@redhat.com> - 0.7.2-2
+- Rebase several patches from upstream which:
+  - Introduce --is-sb-enabled parameter and better return codes
+  - Remove unused int_to_b64()
+  - Show help on unsupported systems
+- Resolves: #RHEL-90836
+- Resolves: #RHEL-90839
+
 * Mon Apr 28 2025 Leo Sandoval <lsandova@redhat.com> - 0.7.2-1
 - Bump version to 0.7.2 upstream tag
 - Resolves: #RHEL-88740