PCR7 is used to record secure boot policy information which is a combination of secure boot configuration and how each application is verified. Shim does currently use it for measuring some additional non standard variables (MokSBState and SbatLevel), but that's ok because those directly affect secure boot policy.
MokListTrusted affects how the kernel uses entries in MokList after ExitBootServices, and so it feels a bit weird here because it's not directly related to secure boot policy. The existing MokList and MokListX variables are only measured to PCR14.
Shim 15.6 changes the value of PCR7 because of the addition of MokListTrusted in https://github.com/rhboot/shim/pull/423, which gets measured to PCR7:
PCR7 is used to record secure boot policy information which is a combination of secure boot configuration and how each application is verified. Shim does currently use it for measuring some additional non standard variables (
MokSBState
andSbatLevel
), but that's ok because those directly affect secure boot policy.MokListTrusted
affects how the kernel uses entries inMokList
after ExitBootServices, and so it feels a bit weird here because it's not directly related to secure boot policy. The existingMokList
andMokListX
variables are only measured to PCR14.