bundles: disable landlock

Signed-off-by: Morten Linderud <[email protected]>

cmd/sbctl/list-bundles.go

@@ -9,7 +9,6 @@ import (
 	"github.com/foxboron/sbctl/config"
 	"github.com/foxboron/sbctl/hierarchy"
 	"github.com/foxboron/sbctl/logging"
-	"github.com/foxboron/sbctl/lsm"
 	"github.com/spf13/cobra"
 )
 
@@ -29,11 +28,11 @@ var listBundlesCmd = &cobra.Command{
 
 		logging.Errorf("The bundle/uki support in sbctl is deprecated. Please move to dracut/mkinitcpio/ukify.")
 
-		if state.Config.Landlock {
-			if err := lsm.Restrict(); err != nil {
-				return err
-			}
-		}
+		// if state.Config.Landlock {
+		// 	if err := lsm.Restrict(); err != nil {
+		// 		return err
+		// 	}
+		// }
 
 		bundles := []JsonBundle{}
 		var isSigned bool

cmd/sbctl/sign-all.go

@@ -22,7 +22,8 @@ var signAllCmd = &cobra.Command{
 	Short: "Sign all enrolled files with secure boot keys",
 	RunE: func(cmd *cobra.Command, args []string) error {
 		state := cmd.Context().Value(stateDataKey{}).(*config.State)
-		if state.Config.Landlock {
+		// Don't run landlock if we are making UKIs
+		if state.Config.Landlock && !generate {
 			if err := sbctl.LandlockFromFileDatabase(state); err != nil {
 				return err
 			}