boot: Add disabled secure boot mode without setup mode

src/fundamental/efivars-fundamental.c

@@ -4,6 +4,7 @@
 
 static const sd_char * const table[_SECURE_BOOT_MAX] = {
         [SECURE_BOOT_UNSUPPORTED] = STR_C("unsupported"),
+        [SECURE_BOOT_DISABLED]    = STR_C("disabled"),
         [SECURE_BOOT_UNKNOWN]     = STR_C("unknown"),
         [SECURE_BOOT_AUDIT]       = STR_C("audit"),
         [SECURE_BOOT_DEPLOYED]    = STR_C("deployed"),
@@ -31,6 +32,11 @@ SecureBootMode decode_secure_boot_mode(
         if (!secure && !deployed && !audit && setup)
                 return SECURE_BOOT_SETUP;
 
+        /* Some firmware allows disabling secure boot while not being in
+         * setup mode unless the PK is cleared. */
+        if (!secure && !deployed && !audit && !setup)
+                return SECURE_BOOT_DISABLED;
+
         /* Well, this should not happen. */
         return SECURE_BOOT_UNKNOWN;
 }

src/fundamental/efivars-fundamental.h

@@ -19,6 +19,7 @@
 
 typedef enum SecureBootMode {
         SECURE_BOOT_UNSUPPORTED,
+        SECURE_BOOT_DISABLED,
         SECURE_BOOT_UNKNOWN,
         SECURE_BOOT_AUDIT,
         SECURE_BOOT_DEPLOYED,