OpenCoreUefi: Prohibit unsigned DMG loading with secure boot
@@ -379,6 +379,18 @@ OcLoadAppleSecureBoot (
SecureBootPolicy = AppleImg4SbModeMedium;
}
+ //
+ // We blindly trust DMG contents after signature verification
+ // essentially skipping secure boot in this case.
+ // Do not allow enabling one but not the other.
+ //
+ if (SecureBootPolicy != AppleImg4SbModeDisabled
+ && AsciiStrCmp (OC_BLOB_GET (&Config->Misc.Security.DmgLoading), "Any") == 0) {
+ DEBUG ((DEBUG_ERROR, "OC: Cannot use Secure Boot with Any DmgLoading!\n"));
+ CpuDeadLoop ();
+ return;
+ }
+
DEBUG ((
DEBUG_INFO,
"OC: Loading Apple Secure Boot with %a (level %u)\n",
