From d01fc56ea2645d45e46acf42f0d0969449940374 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E6=9D=8E=E9=80=9A=E6=B4=B2?= <zhangsongcui3371@sina.com>
Date: Sat, 27 Dec 2025 16:11:16 +0800
Subject: [PATCH] Bootmgr (macOS): supports secure boot detection

---
 src/detection/bootmgr/bootmgr_apple.c | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/src/detection/bootmgr/bootmgr_apple.c b/src/detection/bootmgr/bootmgr_apple.c
index bd4c5dc98..dc8de14b2 100644
--- a/src/detection/bootmgr/bootmgr_apple.c
+++ b/src/detection/bootmgr/bootmgr_apple.c
@@ -1,5 +1,25 @@
 #include "bootmgr.h"
 #include "common/io/io.h"
+#include "util/apple/cf_helpers.h"
+
+#include <IOKit/IOKitLib.h>
+
+FF_MAYBE_UNUSED static const char* detectFromIokit(bool* secureBoot)
+{
+    FF_IOOBJECT_AUTO_RELEASE io_registry_entry_t entryDevice = IORegistryEntryFromPath(kIOMainPortDefault, "IODeviceTree:/chosen");
+    if (!entryDevice)
+        return "IORegistryEntryFromPath() failed";
+
+    FF_CFTYPE_AUTO_RELEASE CFTypeRef prop = IORegistryEntryCreateCFProperty(entryDevice, CFSTR("secure-boot"), kCFAllocatorDefault, 0);
+    if (!prop)
+        return "IORegistryEntryCreateCFProperty() failed";
+
+    if (CFGetTypeID(prop) != CFDataGetTypeID() || CFDataGetLength((CFDataRef) prop) == 0)
+        return "Invalid secure-boot property";
+
+    *secureBoot = (bool) *CFDataGetBytePtr((CFDataRef) prop);
+    return NULL;
+}
 
 const char* ffDetectBootmgr(FFBootmgrResult* result)
 {
@@ -8,5 +28,7 @@ const char* ffDetectBootmgr(FFBootmgrResult* result)
 
     ffStrbufSetStatic(&result->name, "iBoot");
 
+    detectFromIokit(&result->secureBoot);
+
     return NULL;
 }