sd-boot: Be more precise about secure boot modes

Fixes: #11559

src/basic/efivars.c

@@ -293,13 +293,28 @@ bool is_efi_secure_boot(void) {
         return cache > 0;
 }
 
-bool is_efi_secure_boot_setup_mode(void) {
-        static int cache = -1;
+SecureBootMode efi_get_secure_boot_mode(void) {
+        static SecureBootMode cache = _SECURE_BOOT_INVALID;
 
-        if (cache < 0)
-                cache = read_flag(EFI_GLOBAL_VARIABLE(SetupMode));
+        if (cache != _SECURE_BOOT_INVALID)
+                return cache;
 
-        return cache > 0;
+        int secure = read_flag(EFI_GLOBAL_VARIABLE(SecureBoot));
+        if (secure < 0) {
+                if (secure != -ENOENT)
+                        log_debug_errno(secure, "Error reading SecureBoot EFI variable: %m");
+                return (cache = SECURE_BOOT_UNSUPPORTED);
+        }
+
+        /* We can assume false for all these if they are abscent (AuditMode and
+         * DeployedMode may not exist on older firmware). */
+        int audit    = read_flag(EFI_GLOBAL_VARIABLE(AuditMode));
+        int deployed = read_flag(EFI_GLOBAL_VARIABLE(DeployedMode));
+        int setup    = read_flag(EFI_GLOBAL_VARIABLE(SetupMode));
+        log_debug("Secure boot variables: SecureBoot=%d AuditMode=%d DeployedMode=%d SetupMode=%d",
+                  secure, audit, deployed, setup);
+
+        return (cache = decode_secure_boot_mode(secure, audit > 0, deployed > 0, setup > 0));
 }
 
 static int read_efi_options_variable(char **line) {

src/basic/efivars.h

@@ -10,6 +10,7 @@
 
 #include "sd-id128.h"
 
+#include "efivars-fundamental.h"
 #include "time-util.h"
 
 #define EFI_VENDOR_LOADER      SD_ID128_MAKE(4a,67,b0,82,0a,4c,41,cf,b6,c7,44,0b,29,bb,8c,4f)
@@ -48,7 +49,7 @@ int efi_set_variable_string(const char *variable, const char *p);
 
 bool is_efi_boot(void);
 bool is_efi_secure_boot(void);
-bool is_efi_secure_boot_setup_mode(void);
+SecureBootMode efi_get_secure_boot_mode(void);
 
 int cache_efi_options_variable(void);
 int systemd_efi_options_variable(char **line);
@@ -80,8 +81,8 @@ static inline bool is_efi_secure_boot(void) {
         return false;
 }
 
-static inline bool is_efi_secure_boot_setup_mode(void) {
-        return false;
+static inline SecureBootMode efi_get_secure_boot_mode(void) {
+        return SECURE_BOOT_UNKNOWN;
 }
 
 static inline int cache_efi_options_variable(void) {