[build] Mark known reviewed files as permitted for UEFI Secure Boot

Some past security reviews carried out for UEFI Secure Boot signing
submissions have covered specific drivers or functional areas of iPXE.
Mark all of the files comprising these areas as permitted for UEFI
Secure Boot.

Signed-off-by: Michael Brown <mcb30@ipxe.org>

87 files changed, 89 insertions, 0 deletions

diff --git a/src/include/hci/digest_cmd.h b/src/include/hci/digest_cmd.h
index 0986f775e..9cb4fde1a 100644
--- a/src/include/hci/digest_cmd.h
+++ b/src/include/hci/digest_cmd.h
@@ -25,6 +25,7 @@
 #define _DIGEST_CMD_H
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 #include <ipxe/crypto.h>
 #include <ipxe/command.h>
diff --git a/src/include/ipxe/acpimac.h b/src/include/ipxe/acpimac.h
index de673eb28..074165a92 100644
--- a/src/include/ipxe/acpimac.h
+++ b/src/include/ipxe/acpimac.h
@@ -8,6 +8,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 extern int acpi_mac ( uint8_t *hw_addr );
 
diff --git a/src/include/ipxe/aes.h b/src/include/ipxe/aes.h
index 8731de6ba..1c0024ccb 100644
--- a/src/include/ipxe/aes.h
+++ b/src/include/ipxe/aes.h
@@ -8,6 +8,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 #include <ipxe/crypto.h>
 
diff --git a/src/include/ipxe/bigint.h b/src/include/ipxe/bigint.h
index 9eab89d25..9c31f4540 100644
--- a/src/include/ipxe/bigint.h
+++ b/src/include/ipxe/bigint.h
@@ -7,6 +7,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 #include <assert.h>
 
diff --git a/src/include/ipxe/bitops.h b/src/include/ipxe/bitops.h
index 7366cd9f1..59a4fb442 100644
--- a/src/include/ipxe/bitops.h
+++ b/src/include/ipxe/bitops.h
@@ -8,6 +8,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 #include <bits/bitops.h>
 
diff --git a/src/include/ipxe/cbc.h b/src/include/ipxe/cbc.h
index f02e51937..154fc5666 100644
--- a/src/include/ipxe/cbc.h
+++ b/src/include/ipxe/cbc.h
@@ -8,6 +8,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 #include <ipxe/crypto.h>
 
diff --git a/src/include/ipxe/cdc.h b/src/include/ipxe/cdc.h
index b8b4a59d9..a61fe61ea 100644
--- a/src/include/ipxe/cdc.h
+++ b/src/include/ipxe/cdc.h
@@ -8,6 +8,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 #include <ipxe/usb.h>
 
diff --git a/src/include/ipxe/certstore.h b/src/include/ipxe/certstore.h
index e276d6792..293f6dec7 100644
--- a/src/include/ipxe/certstore.h
+++ b/src/include/ipxe/certstore.h
@@ -8,6 +8,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 #include <ipxe/x509.h>
 
diff --git a/src/include/ipxe/cms.h b/src/include/ipxe/cms.h
index 084cd81f8..d2e426c5c 100644
--- a/src/include/ipxe/cms.h
+++ b/src/include/ipxe/cms.h
@@ -8,6 +8,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 #include <time.h>
 #include <ipxe/asn1.h>
diff --git a/src/include/ipxe/deflate.h b/src/include/ipxe/deflate.h
index 67292d77e..7e5ae01b9 100644
--- a/src/include/ipxe/deflate.h
+++ b/src/include/ipxe/deflate.h
@@ -8,6 +8,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 #include <stdint.h>
 #include <string.h>
diff --git a/src/include/ipxe/der.h b/src/include/ipxe/der.h
index 512bc0853..17e96405e 100644
--- a/src/include/ipxe/der.h
+++ b/src/include/ipxe/der.h
@@ -8,6 +8,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 #include <stdint.h>
 #include <ipxe/asn1.h>
diff --git a/src/include/ipxe/dhe.h b/src/include/ipxe/dhe.h
index 3cd24a880..f89e7bd02 100644
--- a/src/include/ipxe/dhe.h
+++ b/src/include/ipxe/dhe.h
@@ -8,6 +8,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 #include <stdint.h>
 
diff --git a/src/include/ipxe/drbg.h b/src/include/ipxe/drbg.h
index ed2b3757a..0512f0833 100644
--- a/src/include/ipxe/drbg.h
+++ b/src/include/ipxe/drbg.h
@@ -8,6 +8,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 #include <stdint.h>
 #include <ipxe/sha256.h>
diff --git a/src/include/ipxe/ecb.h b/src/include/ipxe/ecb.h
index db22d996d..c29602fca 100644
--- a/src/include/ipxe/ecb.h
+++ b/src/include/ipxe/ecb.h
@@ -8,6 +8,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 #include <ipxe/crypto.h>
 
diff --git a/src/include/ipxe/ecdhe.h b/src/include/ipxe/ecdhe.h
index 36fc0a1ee..c6575678c 100644
--- a/src/include/ipxe/ecdhe.h
+++ b/src/include/ipxe/ecdhe.h
@@ -8,6 +8,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 #include <ipxe/crypto.h>
 
diff --git a/src/include/ipxe/ecdsa.h b/src/include/ipxe/ecdsa.h
index f55af3973..fdf8c6159 100644
--- a/src/include/ipxe/ecdsa.h
+++ b/src/include/ipxe/ecdsa.h
@@ -8,6 +8,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 #include <ipxe/crypto.h>
 
diff --git a/src/include/ipxe/efi/efi_siglist.h b/src/include/ipxe/efi/efi_siglist.h
index cbc835dc0..f2a2fcfd0 100644
--- a/src/include/ipxe/efi/efi_siglist.h
+++ b/src/include/ipxe/efi/efi_siglist.h
@@ -8,6 +8,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 #include <stdint.h>
 #include <ipxe/asn1.h>
diff --git a/src/include/ipxe/efi/efi_usb.h b/src/include/ipxe/efi/efi_usb.h
index 06baff529..cbcef0e52 100644
--- a/src/include/ipxe/efi/efi_usb.h
+++ b/src/include/ipxe/efi/efi_usb.h
@@ -7,6 +7,9 @@
  *
  */
 
+FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
+
 #include <ipxe/list.h>
 #include <ipxe/efi/efi.h>
 #include <ipxe/efi/efi_driver.h>
diff --git a/src/include/ipxe/entropy.h b/src/include/ipxe/entropy.h
index 82bb11826..8ec8f1047 100644
--- a/src/include/ipxe/entropy.h
+++ b/src/include/ipxe/entropy.h
@@ -8,6 +8,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 #include <stdint.h>
 #include <string.h>
diff --git a/src/include/ipxe/fbcon.h b/src/include/ipxe/fbcon.h
index 5233b4d0e..75cda3390 100644
--- a/src/include/ipxe/fbcon.h
+++ b/src/include/ipxe/fbcon.h
@@ -8,6 +8,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 #include <stdint.h>
 #include <ipxe/ansiesc.h>
diff --git a/src/include/ipxe/fdt.h b/src/include/ipxe/fdt.h
index e951aea59..6aa078ff6 100644
--- a/src/include/ipxe/fdt.h
+++ b/src/include/ipxe/fdt.h
@@ -8,6 +8,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 #include <stdint.h>
 #include <ipxe/image.h>
diff --git a/src/include/ipxe/gcm.h b/src/include/ipxe/gcm.h
index 2c785a977..5635a1031 100644
--- a/src/include/ipxe/gcm.h
+++ b/src/include/ipxe/gcm.h
@@ -8,6 +8,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 #include <stdint.h>
 #include <ipxe/crypto.h>
diff --git a/src/include/ipxe/hash_df.h b/src/include/ipxe/hash_df.h
index e57682446..61c3420ce 100644
--- a/src/include/ipxe/hash_df.h
+++ b/src/include/ipxe/hash_df.h
@@ -8,6 +8,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 #include <stdint.h>
 #include <ipxe/crypto.h>
diff --git a/src/include/ipxe/hmac.h b/src/include/ipxe/hmac.h
index cf9d08677..12312c540 100644
--- a/src/include/ipxe/hmac.h
+++ b/src/include/ipxe/hmac.h
@@ -7,6 +7,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 #include <ipxe/crypto.h>
 
diff --git a/src/include/ipxe/hmac_drbg.h b/src/include/ipxe/hmac_drbg.h
index a0f22da75..e9113807c 100644
--- a/src/include/ipxe/hmac_drbg.h
+++ b/src/include/ipxe/hmac_drbg.h
@@ -8,6 +8,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 #include <stdint.h>
 #include <ipxe/crypto.h>
diff --git a/src/include/ipxe/isqrt.h b/src/include/ipxe/isqrt.h
index 68255d1bc..4308cebd2 100644
--- a/src/include/ipxe/isqrt.h
+++ b/src/include/ipxe/isqrt.h
@@ -8,6 +8,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 extern unsigned long isqrt ( unsigned long value );
 
diff --git a/src/include/ipxe/lineconsole.h b/src/include/ipxe/lineconsole.h
index 31117e73c..b02822dcf 100644
--- a/src/include/ipxe/lineconsole.h
+++ b/src/include/ipxe/lineconsole.h
@@ -8,6 +8,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 #include <stdint.h>
 #include <ipxe/ansiesc.h>
diff --git a/src/include/ipxe/md4.h b/src/include/ipxe/md4.h
index 9f6cb8a5f..60512993b 100644
--- a/src/include/ipxe/md4.h
+++ b/src/include/ipxe/md4.h
@@ -8,6 +8,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 #include <stdint.h>
 #include <ipxe/crypto.h>
diff --git a/src/include/ipxe/mii.h b/src/include/ipxe/mii.h
index 89fc92a4a..061aeb24e 100644
--- a/src/include/ipxe/mii.h
+++ b/src/include/ipxe/mii.h
@@ -8,6 +8,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 #include <mii.h>
 #include <ipxe/netdevice.h>
diff --git a/src/include/ipxe/netbios.h b/src/include/ipxe/netbios.h
index c11552556..80f791738 100644
--- a/src/include/ipxe/netbios.h
+++ b/src/include/ipxe/netbios.h
@@ -8,6 +8,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 extern const char * netbios_domain ( char **username );
 
diff --git a/src/include/ipxe/ntp.h b/src/include/ipxe/ntp.h
index f5b3d2326..7f83c6d4f 100644
--- a/src/include/ipxe/ntp.h
+++ b/src/include/ipxe/ntp.h
@@ -8,6 +8,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 #include <stdint.h>
 #include <ipxe/in.h>
diff --git a/src/include/ipxe/ocsp.h b/src/include/ipxe/ocsp.h
index a973f6f5e..9302506f8 100644
--- a/src/include/ipxe/ocsp.h
+++ b/src/include/ipxe/ocsp.h
@@ -8,6 +8,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 #include <stdarg.h>
 #include <time.h>
diff --git a/src/include/ipxe/p256.h b/src/include/ipxe/p256.h
index 0c4e81665..14d429cd9 100644
--- a/src/include/ipxe/p256.h
+++ b/src/include/ipxe/p256.h
@@ -8,6 +8,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 #include <ipxe/weierstrass.h>
 
diff --git a/src/include/ipxe/p384.h b/src/include/ipxe/p384.h
index f4631b5f2..2fdd8d13c 100644
--- a/src/include/ipxe/p384.h
+++ b/src/include/ipxe/p384.h
@@ -8,6 +8,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 #include <ipxe/weierstrass.h>
 
diff --git a/src/include/ipxe/pccrc.h b/src/include/ipxe/pccrc.h
index bec2b271a..6d0e3f194 100644
--- a/src/include/ipxe/pccrc.h
+++ b/src/include/ipxe/pccrc.h
@@ -8,6 +8,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 #include <stdint.h>
 #include <byteswap.h>
diff --git a/src/include/ipxe/pccrd.h b/src/include/ipxe/pccrd.h
index 3daa92f29..453ef666d 100644
--- a/src/include/ipxe/pccrd.h
+++ b/src/include/ipxe/pccrd.h
@@ -8,6 +8,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 /** PeerDist discovery port */
 #define PEERDIST_DISCOVERY_PORT 3702
diff --git a/src/include/ipxe/pccrr.h b/src/include/ipxe/pccrr.h
index 4de94fda3..92522d0b7 100644
--- a/src/include/ipxe/pccrr.h
+++ b/src/include/ipxe/pccrr.h
@@ -10,6 +10,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 #include <stdint.h>
 
diff --git a/src/include/ipxe/pcibackup.h b/src/include/ipxe/pcibackup.h
index e5249df99..a25421d7d 100644
--- a/src/include/ipxe/pcibackup.h
+++ b/src/include/ipxe/pcibackup.h
@@ -8,6 +8,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 #include <stdint.h>
 
diff --git a/src/include/ipxe/pcimsix.h b/src/include/ipxe/pcimsix.h
index b40c6c357..a7a6899a9 100644
--- a/src/include/ipxe/pcimsix.h
+++ b/src/include/ipxe/pcimsix.h
@@ -8,6 +8,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 #include <ipxe/pci.h>
 
diff --git a/src/include/ipxe/peerblk.h b/src/include/ipxe/peerblk.h
index f16f207b0..596c78b57 100644
--- a/src/include/ipxe/peerblk.h
+++ b/src/include/ipxe/peerblk.h
@@ -8,6 +8,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 #include <stdint.h>
 #include <ipxe/refcnt.h>
diff --git a/src/include/ipxe/peerdisc.h b/src/include/ipxe/peerdisc.h
index 45d592e76..9a8f13ecf 100644
--- a/src/include/ipxe/peerdisc.h
+++ b/src/include/ipxe/peerdisc.h
@@ -8,6 +8,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 #include <stdint.h>
 #include <ipxe/refcnt.h>
diff --git a/src/include/ipxe/peermux.h b/src/include/ipxe/peermux.h
index 54acbfec9..849488d0a 100644
--- a/src/include/ipxe/peermux.h
+++ b/src/include/ipxe/peermux.h
@@ -8,6 +8,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 #include <stdint.h>
 #include <ipxe/list.h>
diff --git a/src/include/ipxe/pem.h b/src/include/ipxe/pem.h
index d9ca017d5..95c55408b 100644
--- a/src/include/ipxe/pem.h
+++ b/src/include/ipxe/pem.h
@@ -8,6 +8,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 #include <stdint.h>
 #include <ipxe/asn1.h>
diff --git a/src/include/ipxe/pinger.h b/src/include/ipxe/pinger.h
index 227f002dc..ade12ec12 100644
--- a/src/include/ipxe/pinger.h
+++ b/src/include/ipxe/pinger.h
@@ -8,6 +8,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 #include <stdint.h>
 #include <ipxe/interface.h>
diff --git a/src/include/ipxe/pixbuf.h b/src/include/ipxe/pixbuf.h
index 47ea0065e..e2cbcdca7 100644
--- a/src/include/ipxe/pixbuf.h
+++ b/src/include/ipxe/pixbuf.h
@@ -8,6 +8,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 #include <stddef.h>
 #include <ipxe/refcnt.h>
diff --git a/src/include/ipxe/png.h b/src/include/ipxe/png.h
index 3505eefc8..31cac0534 100644
--- a/src/include/ipxe/png.h
+++ b/src/include/ipxe/png.h
@@ -8,6 +8,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 #include <stdint.h>
 #include <byteswap.h>
diff --git a/src/include/ipxe/privkey.h b/src/include/ipxe/privkey.h
index a65cf6106..56f23143e 100644
--- a/src/include/ipxe/privkey.h
+++ b/src/include/ipxe/privkey.h
@@ -8,6 +8,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 #include <ipxe/asn1.h>
 #include <ipxe/refcnt.h>
diff --git a/src/include/ipxe/random_nz.h b/src/include/ipxe/random_nz.h
index 4c433fa38..2de1a1a33 100644
--- a/src/include/ipxe/random_nz.h
+++ b/src/include/ipxe/random_nz.h
@@ -8,6 +8,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 #include <stdint.h>
 
diff --git a/src/include/ipxe/rbg.h b/src/include/ipxe/rbg.h
index 4bf3055d1..0b65a408c 100644
--- a/src/include/ipxe/rbg.h
+++ b/src/include/ipxe/rbg.h
@@ -8,6 +8,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 #include <stdint.h>
 #include <ipxe/drbg.h>
diff --git a/src/include/ipxe/rndis.h b/src/include/ipxe/rndis.h
index e8ece1e85..bd64eddfe 100644
--- a/src/include/ipxe/rndis.h
+++ b/src/include/ipxe/rndis.h
@@ -8,6 +8,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 #include <stdint.h>
 #include <ipxe/netdevice.h>
diff --git a/src/include/ipxe/rootcert.h b/src/include/ipxe/rootcert.h
index d1a69723d..f07c612ff 100644
--- a/src/include/ipxe/rootcert.h
+++ b/src/include/ipxe/rootcert.h
@@ -8,6 +8,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 #include <ipxe/x509.h>
 
diff --git a/src/include/ipxe/rsa.h b/src/include/ipxe/rsa.h
index e36a75edf..c5ae919ae 100644
--- a/src/include/ipxe/rsa.h
+++ b/src/include/ipxe/rsa.h
@@ -7,6 +7,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 #include <stdarg.h>
 #include <ipxe/crypto.h>
diff --git a/src/include/ipxe/sha1.h b/src/include/ipxe/sha1.h
index 9cbbebdee..33b07ecc3 100644
--- a/src/include/ipxe/sha1.h
+++ b/src/include/ipxe/sha1.h
@@ -8,6 +8,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER );
+FILE_SECBOOT ( PERMITTED );
 
 #include <stdint.h>
 #include <ipxe/crypto.h>
diff --git a/src/include/ipxe/sha256.h b/src/include/ipxe/sha256.h
index f226ad07b..e8a81b889 100644
--- a/src/include/ipxe/sha256.h
+++ b/src/include/ipxe/sha256.h
@@ -8,6 +8,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 #include <stdint.h>
 #include <ipxe/crypto.h>
diff --git a/src/include/ipxe/sha512.h b/src/include/ipxe/sha512.h
index 82a9e4e69..74cdb413c 100644
--- a/src/include/ipxe/sha512.h
+++ b/src/include/ipxe/sha512.h
@@ -8,6 +8,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 #include <stdint.h>
 #include <ipxe/crypto.h>
diff --git a/src/include/ipxe/syslog.h b/src/include/ipxe/syslog.h
index 138440d66..67f45fdb4 100644
--- a/src/include/ipxe/syslog.h
+++ b/src/include/ipxe/syslog.h
@@ -8,6 +8,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 #include <syslog.h>
 
diff --git a/src/include/ipxe/tls.h b/src/include/ipxe/tls.h
index 1a1d9c982..b4a92a044 100644
--- a/src/include/ipxe/tls.h
+++ b/src/include/ipxe/tls.h
@@ -8,6 +8,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 #include <stdint.h>
 #include <ipxe/refcnt.h>
diff --git a/src/include/ipxe/usbnet.h b/src/include/ipxe/usbnet.h
index a7276eba5..937a26d9a 100644
--- a/src/include/ipxe/usbnet.h
+++ b/src/include/ipxe/usbnet.h
@@ -8,6 +8,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 #include <ipxe/usb.h>
 
diff --git a/src/include/ipxe/validator.h b/src/include/ipxe/validator.h
index 367e4045d..4d95766fa 100644
--- a/src/include/ipxe/validator.h
+++ b/src/include/ipxe/validator.h
@@ -8,6 +8,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 #include <ipxe/interface.h>
 #include <ipxe/x509.h>
diff --git a/src/include/ipxe/weierstrass.h b/src/include/ipxe/weierstrass.h
index 15dd9ce03..ced99b4fc 100644
--- a/src/include/ipxe/weierstrass.h
+++ b/src/include/ipxe/weierstrass.h
@@ -8,6 +8,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 #include <ipxe/bigint.h>
 #include <ipxe/crypto.h>
diff --git a/src/include/ipxe/x25519.h b/src/include/ipxe/x25519.h
index d570282c5..ef294f7b2 100644
--- a/src/include/ipxe/x25519.h
+++ b/src/include/ipxe/x25519.h
@@ -8,6 +8,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 #include <stdint.h>
 #include <ipxe/bigint.h>
diff --git a/src/include/ipxe/x509.h b/src/include/ipxe/x509.h
index 4903eb656..360e2b19a 100644
--- a/src/include/ipxe/x509.h
+++ b/src/include/ipxe/x509.h
@@ -8,6 +8,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 #include <stdint.h>
 #include <stddef.h>
diff --git a/src/include/ipxe/xen.h b/src/include/ipxe/xen.h
index 382901ff3..9ddfcdf81 100644
--- a/src/include/ipxe/xen.h
+++ b/src/include/ipxe/xen.h
@@ -8,6 +8,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 /* Define Xen interface version before including any Xen header files */
 #define __XEN_INTERFACE_VERSION__ 0x00040400
diff --git a/src/include/ipxe/xenbus.h b/src/include/ipxe/xenbus.h
index ec5782eed..d73f29781 100644
--- a/src/include/ipxe/xenbus.h
+++ b/src/include/ipxe/xenbus.h
@@ -8,6 +8,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 #include <ipxe/device.h>
 #include <ipxe/tables.h>
diff --git a/src/include/ipxe/xenevent.h b/src/include/ipxe/xenevent.h
index f0bd3465e..8be9e2b2f 100644
--- a/src/include/ipxe/xenevent.h
+++ b/src/include/ipxe/xenevent.h
@@ -8,6 +8,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 #include <ipxe/xen.h>
 #include <xen/event_channel.h>
diff --git a/src/include/ipxe/xengrant.h b/src/include/ipxe/xengrant.h
index fcb7a7157..8af27f3e3 100644
--- a/src/include/ipxe/xengrant.h
+++ b/src/include/ipxe/xengrant.h
@@ -8,6 +8,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 #include <stdint.h>
 #include <stdlib.h>
diff --git a/src/include/ipxe/xenstore.h b/src/include/ipxe/xenstore.h
index 892640755..c2079cec5 100644
--- a/src/include/ipxe/xenstore.h
+++ b/src/include/ipxe/xenstore.h
@@ -8,6 +8,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 #include <ipxe/xen.h>
 
diff --git a/src/include/ipxe/xhci.h b/src/include/ipxe/xhci.h
index 586d5d320..2f5c256a0 100644
--- a/src/include/ipxe/xhci.h
+++ b/src/include/ipxe/xhci.h
@@ -8,6 +8,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 #include <assert.h>
 #include <ipxe/pci.h>
diff --git a/src/include/mii.h b/src/include/mii.h
index 515ba224d..9d6b2b3b7 100644
--- a/src/include/mii.h
+++ b/src/include/mii.h
@@ -12,6 +12,7 @@
  */
 
 FILE_LICENCE ( GPL2_ONLY );
+FILE_SECBOOT ( PERMITTED );
 
 /* Generic MII registers. */
 #define MII_BMCR	    0x00	/* Basic mode control register */
diff --git a/src/include/usr/certmgmt.h b/src/include/usr/certmgmt.h
index 4363b03e1..ff646236b 100644
--- a/src/include/usr/certmgmt.h
+++ b/src/include/usr/certmgmt.h
@@ -8,6 +8,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 #include <ipxe/x509.h>
 
diff --git a/src/include/usr/imgtrust.h b/src/include/usr/imgtrust.h
index 414e07a80..1e43f5d3d 100644
--- a/src/include/usr/imgtrust.h
+++ b/src/include/usr/imgtrust.h
@@ -8,6 +8,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 #include <ipxe/image.h>
 
diff --git a/src/include/usr/ipstat.h b/src/include/usr/ipstat.h
index 803254bcb..2399446eb 100644
--- a/src/include/usr/ipstat.h
+++ b/src/include/usr/ipstat.h
@@ -8,6 +8,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 extern void ipstat ( void );
 
diff --git a/src/include/usr/neighmgmt.h b/src/include/usr/neighmgmt.h
index 06f03716e..5ed5829c4 100644
--- a/src/include/usr/neighmgmt.h
+++ b/src/include/usr/neighmgmt.h
@@ -8,6 +8,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 extern void nstat ( void );
 
diff --git a/src/include/usr/nslookup.h b/src/include/usr/nslookup.h
index d34649e9f..3b2bb504d 100644
--- a/src/include/usr/nslookup.h
+++ b/src/include/usr/nslookup.h
@@ -8,6 +8,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER );
+FILE_SECBOOT ( PERMITTED );
 
 extern int nslookup ( const char *name, const char *setting_name );
 
diff --git a/src/include/usr/ntpmgmt.h b/src/include/usr/ntpmgmt.h
index 284e668e6..6d90ec749 100644
--- a/src/include/usr/ntpmgmt.h
+++ b/src/include/usr/ntpmgmt.h
@@ -8,6 +8,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 extern int ntp ( const char *hostname );
 
diff --git a/src/include/usr/pingmgmt.h b/src/include/usr/pingmgmt.h
index c7a8434be..d15a748d8 100644
--- a/src/include/usr/pingmgmt.h
+++ b/src/include/usr/pingmgmt.h
@@ -8,6 +8,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 #include <stdint.h>
 
diff --git a/src/include/usr/profstat.h b/src/include/usr/profstat.h
index b7812ca7f..c5d545a86 100644
--- a/src/include/usr/profstat.h
+++ b/src/include/usr/profstat.h
@@ -8,6 +8,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 extern void profstat ( void );
 
diff --git a/src/include/xen/arch-x86/xen-x86_64.h b/src/include/xen/arch-x86/xen-x86_64.h
index 8287fd20f..618bf07d7 100644
--- a/src/include/xen/arch-x86/xen-x86_64.h
+++ b/src/include/xen/arch-x86/xen-x86_64.h
@@ -11,6 +11,7 @@
 #define __XEN_PUBLIC_ARCH_X86_XEN_X86_64_H__
 
 FILE_LICENCE ( MIT );
+FILE_SECBOOT ( PERMITTED );
 
 /*
  * Hypercall interface:
diff --git a/src/include/xen/arch-x86/xen.h b/src/include/xen/arch-x86/xen.h
index 2b7afb2f4..7df850650 100644
--- a/src/include/xen/arch-x86/xen.h
+++ b/src/include/xen/arch-x86/xen.h
@@ -13,6 +13,7 @@
 #define __XEN_PUBLIC_ARCH_X86_XEN_H__
 
 FILE_LICENCE ( MIT );
+FILE_SECBOOT ( PERMITTED );
 
 /* Structural guest handles introduced in 0x00030201. */
 #if __XEN_INTERFACE_VERSION__ >= 0x00030201
diff --git a/src/include/xen/event_channel.h b/src/include/xen/event_channel.h
index 0c3752723..a3145d76f 100644
--- a/src/include/xen/event_channel.h
+++ b/src/include/xen/event_channel.h
@@ -11,6 +11,7 @@
 #define __XEN_PUBLIC_EVENT_CHANNEL_H__
 
 FILE_LICENCE ( MIT );
+FILE_SECBOOT ( PERMITTED );
 
 #include "xen.h"
 
diff --git a/src/include/xen/grant_table.h b/src/include/xen/grant_table.h
index f0ae17c41..141a17f56 100644
--- a/src/include/xen/grant_table.h
+++ b/src/include/xen/grant_table.h
@@ -12,6 +12,7 @@
 #define __XEN_PUBLIC_GRANT_TABLE_H__
 
 FILE_LICENCE ( MIT );
+FILE_SECBOOT ( PERMITTED );
 
 #include "xen.h"
 
diff --git a/src/include/xen/io/netif.h b/src/include/xen/io/netif.h
index bec61ab3e..59887a80f 100644
--- a/src/include/xen/io/netif.h
+++ b/src/include/xen/io/netif.h
@@ -11,6 +11,7 @@
 #define __XEN_PUBLIC_IO_NETIF_H__
 
 FILE_LICENCE ( MIT );
+FILE_SECBOOT ( PERMITTED );
 
 #include "ring.h"
 #include "../grant_table.h"
diff --git a/src/include/xen/io/ring.h b/src/include/xen/io/ring.h
index 41b50e2cf..3451bbb52 100644
--- a/src/include/xen/io/ring.h
+++ b/src/include/xen/io/ring.h
@@ -11,6 +11,7 @@
 #define __XEN_PUBLIC_IO_RING_H__
 
 FILE_LICENCE ( MIT );
+FILE_SECBOOT ( PERMITTED );
 
 /*
  * When #include'ing this header, you need to provide the following
diff --git a/src/include/xen/io/xenbus.h b/src/include/xen/io/xenbus.h
index 473f538b8..3bf417c3a 100644
--- a/src/include/xen/io/xenbus.h
+++ b/src/include/xen/io/xenbus.h
@@ -11,6 +11,7 @@
 #define _XEN_PUBLIC_IO_XENBUS_H
 
 FILE_LICENCE ( MIT );
+FILE_SECBOOT ( PERMITTED );
 
 /*
  * The state of either end of the Xenbus, i.e. the current communication
diff --git a/src/include/xen/io/xs_wire.h b/src/include/xen/io/xs_wire.h
index cffd75cde..99dc91781 100644
--- a/src/include/xen/io/xs_wire.h
+++ b/src/include/xen/io/xs_wire.h
@@ -10,6 +10,7 @@
 #define _XS_WIRE_H
 
 FILE_LICENCE ( MIT );
+FILE_SECBOOT ( PERMITTED );
 
 enum xsd_sockmsg_type
 {
diff --git a/src/include/xen/xen-compat.h b/src/include/xen/xen-compat.h
index 8b2361807..8e4ed2434 100644
--- a/src/include/xen/xen-compat.h
+++ b/src/include/xen/xen-compat.h
@@ -11,6 +11,7 @@
 #define __XEN_PUBLIC_XEN_COMPAT_H__
 
 FILE_LICENCE ( MIT );
+FILE_SECBOOT ( PERMITTED );
 
 #define __XEN_LATEST_INTERFACE_VERSION__ 0x00040e00
 
diff --git a/src/include/xen/xen.h b/src/include/xen/xen.h
index c35008aa0..6d8192f8d 100644
--- a/src/include/xen/xen.h
+++ b/src/include/xen/xen.h
@@ -11,6 +11,7 @@
 #define __XEN_PUBLIC_XEN_H__
 
 FILE_LICENCE ( MIT );
+FILE_SECBOOT ( PERMITTED );
 
 #include "xen-compat.h"