Enable kernel lockdown only under EFI Secure Boot

[ixhamza]

Cherry-pick two patches from Debian Backports to enable conditional kernel lockdown only when booted under EFI Secure Boot. This ensures backward compatibility, i.e. systems without Secure Boot support or with Secure Boot disabled remain unaffected (e.g. lockdown=[none]).

1. efi-add-an-efi_secure_boot-flag-to-indicate-secure-boot.patch
2. efi-lock-down-the-kernel-if-booted-in-secure-boot-mode.patch

Note: This is one of the requirements of the shim-review process:
“How does your signed kernel enforce lockdown when your system runs with Secure Boot enabled?
Hint: If it does not, we are not likely to sign your shim.”

Testing

• With Secure Boot Enabled

root@truenas[~]# cat /boot/config-6.12.25-production+truenas | grep SECURE_BOOT
CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT=y
root@truenas[~]# mokutil --sb-state
SecureBoot enabled
root@truenas[~]# cat /sys/kernel/security/lockdown 
none [integrity] confidentiality

• With Secure Boot Disabled

root@truenas[~]# cat /boot/config-6.12.25-production+truenas | grep SECURE_BOOT
CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT=y
root@truenas[~]# mokutil --sb-state
SecureBoot disabled
root@truenas[~]# cat /sys/kernel/security/lockdown 
[none] integrity confidentiality

• Scale Build
• API Tests

[amotin]

No objections, seems we have to. Just wonder what we may lose with it, like PLX configuration on M-series, etc. Also makes me think about possibility of some injection to make kernel think it is not SecureBoot-enabled and so not lock up. ;)