Commit 5f56a74cc0a6d explains why it does check if efi variable "MokSBStateRT" does not have EFI_VARIABLE_NON_VOLATILE attribute. Shouldn't the same logic be applied to "MokIgnoreDB" in 386b49f51dc24 ? Just a reminder "MokIgnoreDB" for "MokDBState" is the same as "MokSBStateRT" for "MokSBState": https://github.com/rhboot/shim/blob/main/mok.c#L128-L131 https://github.com/rhboot/shim/blob/main/mok.c#L142-L145