Mirrored MOK variables could be accidentally deleted

[lcp]

Per the comment of MOK_MIRROR_DELETE_FIRST, any MOK variable with the flag would delete the existing mirrored variable first.

shim/mok.c

Line 127 in 9f973e4

* MOK_MIRROR_DELETE_FIRST delete any existing variable first

The code to mirror a MOK variable is in mirror_mok_db():

shim/mok.c

Lines 373 to 379 in 9f973e4

	if (FullDataSize <= max_var_sz) {
	if (only_first)
	efi_status = SetVariable(name, guid, attrs,
	FullDataSize, FullData);
	return efi_status;
	}

It writes the variable only when only_first is true.

However, in maybe_mirror_one_mok_variable(),

shim/mok.c

Lines 866 to 870 in 9f973e4

	if (!only_first && (v->flags & MOK_MIRROR_DELETE_FIRST)) {
	dprint(L"deleting \"%s\"\n", v->rtname);
	efi_status = LibDeleteVariable(v->rtname, v->guid);
	dprint(L"LibDeleteVariable(\"%s\",...) => %r\n", v->rtname, efi_status);
	}

LibDeleteVariable() is called to delete the mirrored MOK variable when only_first is false.

The logic looks strange to me since it tries to delete the mirrored MOK variable we just created. The problem doesn't show in QEMU/OVMF VMs because LibDeleteVariable() deletes the variables with BS+RT+NV but we create the mirrored variable with BS+RT, so OVMF just returns "EFI_INVALID_PARAMETER". However, for the VMWare VMs, the firmware doesn't check the attributes and just deletes the variable matching the given name+guid, so those RT variables never show in OS.