boot: remove random-seed-mode

Now that the random seed is used on virtualized systems, there's no
point in having a random-seed-mode toggle switch. Let's just always
require it now, with the existing logic already being there to allow not
having it if EFI itself has an RNG. In other words, the logic for this
can now be automatic.

3 files changed, 4 insertions, 47 deletions

diff --git a/src/boot/efi/boot.c b/src/boot/efi/boot.c
index ac9d11aacc..caa2a69a6f 100644
--- a/src/boot/efi/boot.c
+++ b/src/boot/efi/boot.c
@@ -97,7 +97,6 @@ typedef struct {
         bool beep;
         int64_t console_mode;
         int64_t console_mode_efivar;
-        RandomSeedMode random_seed_mode;
 } Config;
 
 /* These values have been chosen so that the transitions the user sees could
@@ -529,7 +528,6 @@ static void print_status(Config *config, char16_t *loaded_image_path) {
           ps_bool(L"         auto-firmware: %s\n", config->auto_firmware);
           ps_bool(L"                  beep: %s\n", config->beep);
           ps_bool(L"  reboot-for-bitlocker: %s\n", config->reboot_for_bitlocker);
-        ps_string(L"      random-seed-mode: %s\n", random_seed_modes_table[config->random_seed_mode]);
 
         switch (config->secure_boot_enroll) {
         case ENROLL_OFF:
@@ -1273,27 +1271,6 @@ static void config_defaults_load_from_file(Config *config, char *content) {
                         }
                         continue;
                 }
-
-                if (streq8(key, "random-seed-mode")) {
-                        if (streq8(value, "off"))
-                                config->random_seed_mode = RANDOM_SEED_OFF;
-                        else if (streq8(value, "with-system-token"))
-                                config->random_seed_mode = RANDOM_SEED_WITH_SYSTEM_TOKEN;
-                        else if (streq8(value, "always"))
-                                config->random_seed_mode = RANDOM_SEED_ALWAYS;
-                        else {
-                                bool on;
-
-                                err = parse_boolean(value, &on);
-                                if (err != EFI_SUCCESS) {
-                                        log_error_stall(L"Error parsing 'random-seed-mode' config option: %a", value);
-                                        continue;
-                                }
-
-                                config->random_seed_mode = on ? RANDOM_SEED_ALWAYS : RANDOM_SEED_OFF;
-                        }
-                        continue;
-                }
         }
 }
 
@@ -1584,7 +1561,6 @@ static void config_load_defaults(Config *config, EFI_FILE *root_dir) {
                 .auto_firmware = true,
                 .reboot_for_bitlocker = false,
                 .secure_boot_enroll = ENROLL_MANUAL,
-                .random_seed_mode = RANDOM_SEED_WITH_SYSTEM_TOKEN,
                 .idx_default_efivar = IDX_INVALID,
                 .console_mode = CONSOLE_MODE_KEEP,
                 .console_mode_efivar = CONSOLE_MODE_KEEP,
@@ -2743,7 +2719,7 @@ EFI_STATUS efi_main(EFI_HANDLE image, EFI_SYSTEM_TABLE *sys_table) {
                 save_selected_entry(&config, entry);
 
                 /* Optionally, read a random seed off the ESP and pass it to the OS */
-                (void) process_random_seed(root_dir, config.random_seed_mode);
+                (void) process_random_seed(root_dir);
 
                 err = image_start(image, entry);
                 if (err != EFI_SUCCESS)
diff --git a/src/boot/efi/random-seed.c b/src/boot/efi/random-seed.c
index e6a317860d..22ba1c5a30 100644
--- a/src/boot/efi/random-seed.c
+++ b/src/boot/efi/random-seed.c
@@ -116,7 +116,7 @@ static void validate_sha256(void) {
 #endif
 }
 
-EFI_STATUS process_random_seed(EFI_FILE *root_dir, RandomSeedMode mode) {
+EFI_STATUS process_random_seed(EFI_FILE *root_dir) {
         _cleanup_erase_ uint8_t random_bytes[DESIRED_SEED_SIZE], hash_key[HASH_VALUE_SIZE];
         _cleanup_free_ struct linux_efi_random_seed *new_seed_table = NULL;
         struct linux_efi_random_seed *previous_seed_table = NULL;
@@ -135,9 +135,6 @@ EFI_STATUS process_random_seed(EFI_FILE *root_dir, RandomSeedMode mode) {
 
         validate_sha256();
 
-        if (mode == RANDOM_SEED_OFF)
-                return EFI_NOT_FOUND;
-
         /* hash = LABEL || sizeof(input1) || input1 || ... || sizeof(inputN) || inputN */
         sha256_init_ctx(&hash);
 
@@ -188,7 +185,7 @@ EFI_STATUS process_random_seed(EFI_FILE *root_dir, RandomSeedMode mode) {
          * system, even when disk images are duplicated or swapped out. */
         size = 0;
         err = acquire_system_token(&system_token, &size);
-        if (mode != RANDOM_SEED_ALWAYS && (err != EFI_SUCCESS || size < DESIRED_SEED_SIZE) && !seeded_by_efi)
+        if ((err != EFI_SUCCESS || size < DESIRED_SEED_SIZE) && !seeded_by_efi)
                 return err;
         sha256_process_bytes(&size, sizeof(size), &hash);
         if (system_token) {
diff --git a/src/boot/efi/random-seed.h b/src/boot/efi/random-seed.h
index 6aa1cc5288..40aaf85860 100644
--- a/src/boot/efi/random-seed.h
+++ b/src/boot/efi/random-seed.h
@@ -2,21 +2,5 @@
 #pragma once
 
 #include <efi.h>
-#include <errno.h>
-#include <uchar.h>
 
-typedef enum RandomSeedMode {
-        RANDOM_SEED_OFF,
-        RANDOM_SEED_WITH_SYSTEM_TOKEN,
-        RANDOM_SEED_ALWAYS,
-        _RANDOM_SEED_MODE_MAX,
-        _RANDOM_SEED_MODE_INVALID = -EINVAL,
-} RandomSeedMode;
-
-static const char16_t * const random_seed_modes_table[_RANDOM_SEED_MODE_MAX] = {
-        [RANDOM_SEED_OFF]               = L"off",
-        [RANDOM_SEED_WITH_SYSTEM_TOKEN] = L"with-system-token",
-        [RANDOM_SEED_ALWAYS]            = L"always",
-};
-
-EFI_STATUS process_random_seed(EFI_FILE *root_dir, RandomSeedMode mode);
+EFI_STATUS process_random_seed(EFI_FILE *root_dir);