From 6cccb3bdc00359068c07125258d71ce24db5118a Mon Sep 17 00:00:00 2001
From: Michael Brown
Date: Wed, 14 Jan 2026 13:25:34 +0000
Subject: [build] Mark core files as permitted for UEFI Secure Boot

Mark all files used in a standard build of bin-x86_64-efi/snponly.efi
as permitted for UEFI Secure Boot.  These files represent the core
functionality of iPXE that is guaranteed to have been included in
every binary that was previously subject to a security review and
signed by Microsoft.  It is therefore legitimate to assume that at
least these files have already been reviewed to the required standard
multiple times.

Signed-off-by: Michael Brown <mcb30@ipxe.org>
---
 src/interface/efi/efi_acpi.c      | 1 +
 src/interface/efi/efi_autoboot.c  | 1 +
 src/interface/efi/efi_autoexec.c  | 1 +
 src/interface/efi/efi_block.c     | 1 +
 src/interface/efi/efi_cachedhcp.c | 1 +
 src/interface/efi/efi_cmdline.c   | 1 +
 src/interface/efi/efi_connect.c   | 1 +
 src/interface/efi/efi_console.c   | 1 +
 src/interface/efi/efi_download.c  | 1 +
 src/interface/efi/efi_driver.c    | 1 +
 src/interface/efi/efi_file.c      | 1 +
 src/interface/efi/efi_guid.c      | 1 +
 src/interface/efi/efi_hii.c       | 1 +
 src/interface/efi/efi_init.c      | 1 +
 src/interface/efi/efi_local.c     | 1 +
 src/interface/efi/efi_nap.c       | 1 +
 src/interface/efi/efi_null.c      | 1 +
 src/interface/efi/efi_open.c      | 1 +
 src/interface/efi/efi_path.c      | 1 +
 src/interface/efi/efi_pci.c       | 1 +
 src/interface/efi/efi_pxe.c       | 1 +
 src/interface/efi/efi_reboot.c    | 1 +
 src/interface/efi/efi_service.c   | 1 +
 src/interface/efi/efi_settings.c  | 1 +
 src/interface/efi/efi_shim.c      | 2 ++
 src/interface/efi/efi_smbios.c    | 1 +
 src/interface/efi/efi_snp.c       | 1 +
 src/interface/efi/efi_snp_hii.c   | 1 +
 src/interface/efi/efi_strings.c   | 1 +
 src/interface/efi/efi_table.c     | 1 +
 src/interface/efi/efi_time.c      | 1 +
 src/interface/efi/efi_timer.c     | 1 +
 src/interface/efi/efi_umalloc.c   | 1 +
 src/interface/efi/efi_utils.c     | 1 +
 src/interface/efi/efi_veto.c      | 1 +
 src/interface/efi/efi_watchdog.c  | 1 +
 src/interface/efi/efi_wrap.c      | 1 +
 src/interface/efi/efiprefix.c     | 1 +
 38 files changed, 39 insertions(+)

(limited to 'src/interface/efi')

diff --git a/src/interface/efi/efi_acpi.c b/src/interface/efi/efi_acpi.c
index a2021a4f6..cb8b4a5d0 100644
--- a/src/interface/efi/efi_acpi.c
+++ b/src/interface/efi/efi_acpi.c
@@ -22,6 +22,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 /**
  * @file
diff --git a/src/interface/efi/efi_autoboot.c b/src/interface/efi/efi_autoboot.c
index e52c857d8..9e0c3e42e 100644
--- a/src/interface/efi/efi_autoboot.c
+++ b/src/interface/efi/efi_autoboot.c
@@ -22,6 +22,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 #include <string.h>
 #include <errno.h>
diff --git a/src/interface/efi/efi_autoexec.c b/src/interface/efi/efi_autoexec.c
index 73ba5df33..b63ac1602 100644
--- a/src/interface/efi/efi_autoexec.c
+++ b/src/interface/efi/efi_autoexec.c
@@ -22,6 +22,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 #include <string.h>
 #include <errno.h>
diff --git a/src/interface/efi/efi_block.c b/src/interface/efi/efi_block.c
index 10952ef8a..0da92307b 100644
--- a/src/interface/efi/efi_block.c
+++ b/src/interface/efi/efi_block.c
@@ -22,6 +22,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 /**
  * @file
diff --git a/src/interface/efi/efi_cachedhcp.c b/src/interface/efi/efi_cachedhcp.c
index 6bba4173a..2f33fcefb 100644
--- a/src/interface/efi/efi_cachedhcp.c
+++ b/src/interface/efi/efi_cachedhcp.c
@@ -22,6 +22,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 #include <string.h>
 #include <errno.h>
diff --git a/src/interface/efi/efi_cmdline.c b/src/interface/efi/efi_cmdline.c
index 8b9d8efde..f5844f2ad 100644
--- a/src/interface/efi/efi_cmdline.c
+++ b/src/interface/efi/efi_cmdline.c
@@ -22,6 +22,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 /** @file
  *
diff --git a/src/interface/efi/efi_connect.c b/src/interface/efi/efi_connect.c
index 5aa8dc689..f4747cf6b 100644
--- a/src/interface/efi/efi_connect.c
+++ b/src/interface/efi/efi_connect.c
@@ -22,6 +22,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 /** @file
  *
diff --git a/src/interface/efi/efi_console.c b/src/interface/efi/efi_console.c
index e896c5d88..afbd722ab 100644
--- a/src/interface/efi/efi_console.c
+++ b/src/interface/efi/efi_console.c
@@ -18,6 +18,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER );
+FILE_SECBOOT ( PERMITTED );
 
 #include <stddef.h>
 #include <string.h>
diff --git a/src/interface/efi/efi_download.c b/src/interface/efi/efi_download.c
index 8d12bd57c..1c2f13573 100644
--- a/src/interface/efi/efi_download.c
+++ b/src/interface/efi/efi_download.c
@@ -17,6 +17,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER );
+FILE_SECBOOT ( PERMITTED );
 
 #include <stdlib.h>
 #include <string.h>
diff --git a/src/interface/efi/efi_driver.c b/src/interface/efi/efi_driver.c
index b1ff404be..cb07af401 100644
--- a/src/interface/efi/efi_driver.c
+++ b/src/interface/efi/efi_driver.c
@@ -18,6 +18,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER );
+FILE_SECBOOT ( PERMITTED );
 
 #include <stddef.h>
 #include <stdlib.h>
diff --git a/src/interface/efi/efi_file.c b/src/interface/efi/efi_file.c
index 1909dea10..2f49b1a99 100644
--- a/src/interface/efi/efi_file.c
+++ b/src/interface/efi/efi_file.c
@@ -22,6 +22,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 /**
  * @file
diff --git a/src/interface/efi/efi_guid.c b/src/interface/efi/efi_guid.c
index 135eeb881..c989aebfe 100644
--- a/src/interface/efi/efi_guid.c
+++ b/src/interface/efi/efi_guid.c
@@ -22,6 +22,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 #include <string.h>
 #include <ipxe/uuid.h>
diff --git a/src/interface/efi/efi_hii.c b/src/interface/efi/efi_hii.c
index 66f58affe..fd65ae122 100644
--- a/src/interface/efi/efi_hii.c
+++ b/src/interface/efi/efi_hii.c
@@ -22,6 +22,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 #include <stdlib.h>
 #include <stddef.h>
diff --git a/src/interface/efi/efi_init.c b/src/interface/efi/efi_init.c
index 69aea0d50..ac62ea747 100644
--- a/src/interface/efi/efi_init.c
+++ b/src/interface/efi/efi_init.c
@@ -18,6 +18,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER );
+FILE_SECBOOT ( PERMITTED );
 
 #include <string.h>
 #include <errno.h>
diff --git a/src/interface/efi/efi_local.c b/src/interface/efi/efi_local.c
index 4564470fc..58a5f689f 100644
--- a/src/interface/efi/efi_local.c
+++ b/src/interface/efi/efi_local.c
@@ -22,6 +22,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 #include <string.h>
 #include <strings.h>
diff --git a/src/interface/efi/efi_nap.c b/src/interface/efi/efi_nap.c
index 2bb47627f..9d97dae6e 100644
--- a/src/interface/efi/efi_nap.c
+++ b/src/interface/efi/efi_nap.c
@@ -22,6 +22,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 #include <ipxe/nap.h>
 #include <ipxe/efi/efi.h>
diff --git a/src/interface/efi/efi_null.c b/src/interface/efi/efi_null.c
index d0f0428cc..fb9ee1780 100644
--- a/src/interface/efi/efi_null.c
+++ b/src/interface/efi/efi_null.c
@@ -22,6 +22,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 #include <string.h>
 #include <ipxe/efi/efi.h>
diff --git a/src/interface/efi/efi_open.c b/src/interface/efi/efi_open.c
index 8f8af4ea0..679d1946e 100644
--- a/src/interface/efi/efi_open.c
+++ b/src/interface/efi/efi_open.c
@@ -22,6 +22,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 /** @file
  *
diff --git a/src/interface/efi/efi_path.c b/src/interface/efi/efi_path.c
index dd0df67e5..37558c36e 100644
--- a/src/interface/efi/efi_path.c
+++ b/src/interface/efi/efi_path.c
@@ -18,6 +18,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER );
+FILE_SECBOOT ( PERMITTED );
 
 #include <stdlib.h>
 #include <stdarg.h>
diff --git a/src/interface/efi/efi_pci.c b/src/interface/efi/efi_pci.c
index f4853c234..4bf3977c5 100644
--- a/src/interface/efi/efi_pci.c
+++ b/src/interface/efi/efi_pci.c
@@ -22,6 +22,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 #include <stdlib.h>
 #include <string.h>
diff --git a/src/interface/efi/efi_pxe.c b/src/interface/efi/efi_pxe.c
index 4ba057019..2d1a6fd73 100644
--- a/src/interface/efi/efi_pxe.c
+++ b/src/interface/efi/efi_pxe.c
@@ -22,6 +22,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 #include <string.h>
 #include <errno.h>
diff --git a/src/interface/efi/efi_reboot.c b/src/interface/efi/efi_reboot.c
index 7ed9f5c84..cc35ef7ad 100644
--- a/src/interface/efi/efi_reboot.c
+++ b/src/interface/efi/efi_reboot.c
@@ -22,6 +22,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 /**
  * @file
diff --git a/src/interface/efi/efi_service.c b/src/interface/efi/efi_service.c
index f10733b24..4e2f2e951 100644
--- a/src/interface/efi/efi_service.c
+++ b/src/interface/efi/efi_service.c
@@ -22,6 +22,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 /** @file
  *
diff --git a/src/interface/efi/efi_settings.c b/src/interface/efi/efi_settings.c
index 5ddbe12f1..95fe2c03c 100644
--- a/src/interface/efi/efi_settings.c
+++ b/src/interface/efi/efi_settings.c
@@ -22,6 +22,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 /**
  * @file
diff --git a/src/interface/efi/efi_shim.c b/src/interface/efi/efi_shim.c
index 4bb6df79f..553cb2721 100644
--- a/src/interface/efi/efi_shim.c
+++ b/src/interface/efi/efi_shim.c
@@ -22,6 +22,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 #include <string.h>
 #include <stdlib.h>
@@ -40,6 +41,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 /**
  * Require use of a third party loader binary
diff --git a/src/interface/efi/efi_smbios.c b/src/interface/efi/efi_smbios.c
index 5d0e69d6b..c10ba1440 100644
--- a/src/interface/efi/efi_smbios.c
+++ b/src/interface/efi/efi_smbios.c
@@ -18,6 +18,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER );
+FILE_SECBOOT ( PERMITTED );
 
 #include <errno.h>
 #include <ipxe/uaccess.h>
diff --git a/src/interface/efi/efi_snp.c b/src/interface/efi/efi_snp.c
index 86ad87bde..dad8b33df 100644
--- a/src/interface/efi/efi_snp.c
+++ b/src/interface/efi/efi_snp.c
@@ -18,6 +18,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER );
+FILE_SECBOOT ( PERMITTED );
 
 #include <stdlib.h>
 #include <string.h>
diff --git a/src/interface/efi/efi_snp_hii.c b/src/interface/efi/efi_snp_hii.c
index 8b65c8a78..25287673a 100644
--- a/src/interface/efi/efi_snp_hii.c
+++ b/src/interface/efi/efi_snp_hii.c
@@ -22,6 +22,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 /**
  * @file
diff --git a/src/interface/efi/efi_strings.c b/src/interface/efi/efi_strings.c
index 765b23ca6..3dae22e41 100644
--- a/src/interface/efi/efi_strings.c
+++ b/src/interface/efi/efi_strings.c
@@ -22,6 +22,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 #include <stddef.h>
 #include <stdarg.h>
diff --git a/src/interface/efi/efi_table.c b/src/interface/efi/efi_table.c
index 3c3f35a4b..da5966a13 100644
--- a/src/interface/efi/efi_table.c
+++ b/src/interface/efi/efi_table.c
@@ -22,6 +22,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 #include <assert.h>
 #include <errno.h>
diff --git a/src/interface/efi/efi_time.c b/src/interface/efi/efi_time.c
index 983a0ef5c..a4c77da20 100644
--- a/src/interface/efi/efi_time.c
+++ b/src/interface/efi/efi_time.c
@@ -22,6 +22,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 #include <string.h>
 #include <errno.h>
diff --git a/src/interface/efi/efi_timer.c b/src/interface/efi/efi_timer.c
index 6427eb1d8..ffb899c86 100644
--- a/src/interface/efi/efi_timer.c
+++ b/src/interface/efi/efi_timer.c
@@ -22,6 +22,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 #include <string.h>
 #include <errno.h>
diff --git a/src/interface/efi/efi_umalloc.c b/src/interface/efi/efi_umalloc.c
index 419d9b294..257b27bec 100644
--- a/src/interface/efi/efi_umalloc.c
+++ b/src/interface/efi/efi_umalloc.c
@@ -22,6 +22,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 #include <string.h>
 #include <errno.h>
diff --git a/src/interface/efi/efi_utils.c b/src/interface/efi/efi_utils.c
index 51da06172..a7008afd4 100644
--- a/src/interface/efi/efi_utils.c
+++ b/src/interface/efi/efi_utils.c
@@ -18,6 +18,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER );
+FILE_SECBOOT ( PERMITTED );
 
 #include <stdio.h>
 #include <string.h>
diff --git a/src/interface/efi/efi_veto.c b/src/interface/efi/efi_veto.c
index da585db60..788515dd1 100644
--- a/src/interface/efi/efi_veto.c
+++ b/src/interface/efi/efi_veto.c
@@ -18,6 +18,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 #include <stddef.h>
 #include <stdlib.h>
diff --git a/src/interface/efi/efi_watchdog.c b/src/interface/efi/efi_watchdog.c
index dcc9a5668..5e4eb626c 100644
--- a/src/interface/efi/efi_watchdog.c
+++ b/src/interface/efi/efi_watchdog.c
@@ -22,6 +22,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 /**
  * @file
diff --git a/src/interface/efi/efi_wrap.c b/src/interface/efi/efi_wrap.c
index 320a32f02..572d05aac 100644
--- a/src/interface/efi/efi_wrap.c
+++ b/src/interface/efi/efi_wrap.c
@@ -22,6 +22,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
+FILE_SECBOOT ( PERMITTED );
 
 /**
  * @file
diff --git a/src/interface/efi/efiprefix.c b/src/interface/efi/efiprefix.c
index 64122185a..3c095afdc 100644
--- a/src/interface/efi/efiprefix.c
+++ b/src/interface/efi/efiprefix.c
@@ -18,6 +18,7 @@
  */
 
 FILE_LICENCE ( GPL2_OR_LATER );
+FILE_SECBOOT ( PERMITTED );
 
 #include <stdlib.h>
 #include <errno.h>
-- 
cgit v1.2.3-55-g7522