Enable the use of power off instead of reboot for secure boot enrollment

For systemd v256 only
Allows setting the secure-boot-enroll-poweroff option in the loader.conf to a bool value to enable the
use of power off instead of reboot after a successful secure boot enrollment.

diff --git a/src/boot/efi/boot.c b/src/boot/efi/boot.c
index 5e6f142dd7..b2ef269682 100644
--- a/src/boot/efi/boot.c
+++ b/src/boot/efi/boot.c
@@ -92,6 +92,7 @@ typedef struct {
         bool auto_reboot;
         bool reboot_for_bitlocker;
         secure_boot_enroll secure_boot_enroll;
+        bool secure_boot_enroll_poweroff;
         bool force_menu;
         bool use_saved_entry;
         bool use_saved_entry_efivar;
@@ -539,12 +540,15 @@ static void print_status(Config *config, char16_t *loaded_image_path) {
                 break;
         case ENROLL_MANUAL:
                 printf("    secure-boot-enroll: manual\n");
+                printf("    secure-boot-enroll-poweroff: %ls\n", yes_no(config->secure_boot_enroll_poweroff));
                 break;
         case ENROLL_IF_SAFE:
                 printf("    secure-boot-enroll: if-safe\n");
+                printf("    secure-boot-enroll-poweroff: %ls\n", yes_no(config->secure_boot_enroll_poweroff));
                 break;
         case ENROLL_FORCE:
                 printf("    secure-boot-enroll: force\n");
+                printf("    secure-boot-enroll-poweroff: %ls\n", yes_no(config->secure_boot_enroll_poweroff));
                 break;
         default:
                 assert_not_reached();
@@ -1270,7 +1274,9 @@ static void config_defaults_load_from_file(Config *config, char *content) {
                         else
                                 log_error("Error parsing 'secure-boot-enroll' config option, ignoring: %s",
                                           value);
-
+                } else if (streq8(key, "secure-boot-enroll-poweroff")) {
+                        if (!parse_boolean(value, &config->secure_boot_enroll_poweroff))
+                                log_error("Error parsing 'secure-boot-enroll-poweroff' config option, ignoring: %s", value);
                 } else if (streq8(key, "console-mode")) {
                         if (streq8(value, "auto"))
                                 config->console_mode = CONSOLE_MODE_AUTO;
@@ -1566,6 +1572,7 @@ static void config_load_defaults(Config *config, EFI_FILE *root_dir) {
                 .auto_entries = true,
                 .auto_firmware = true,
                 .secure_boot_enroll = ENROLL_IF_SAFE,
+                .secure_boot_enroll_poweroff = false,
                 .idx_default_efivar = IDX_INVALID,
                 .console_mode = CONSOLE_MODE_KEEP,
                 .console_mode_efivar = CONSOLE_MODE_KEEP,
@@ -2560,7 +2567,7 @@ static EFI_STATUS secure_boot_discover_keys(Config *config, EFI_FILE *root_dir)
                     strcaseeq16(dirent->FileName, u"auto"))
                         /* If we auto enroll successfully this call does not return.
                          * If it fails we still want to add other potential entries to the menu. */
-                        secure_boot_enroll_at(root_dir, entry->path, config->secure_boot_enroll == ENROLL_FORCE);
+                        secure_boot_enroll_at(root_dir, entry->path, config->secure_boot_enroll == ENROLL_FORCE, config->secure_boot_enroll_poweroff);
         }
 
         return EFI_SUCCESS;
@@ -2771,7 +2778,7 @@ static EFI_STATUS run(EFI_HANDLE image) {
 
                 /* if auto enrollment is activated, we try to load keys for the given entry. */
                 if (entry->type == LOADER_SECURE_BOOT_KEYS && config.secure_boot_enroll != ENROLL_OFF) {
-                        err = secure_boot_enroll_at(root_dir, entry->path, /*force=*/ true);
+                        err = secure_boot_enroll_at(root_dir, entry->path, /*force=*/ true, config.secure_boot_enroll_poweroff);
                         if (err != EFI_SUCCESS)
                                 return err;
                         continue;
diff --git a/src/boot/efi/secure-boot.c b/src/boot/efi/secure-boot.c
index 2400324fc5..c4a13fdf8f 100644
--- a/src/boot/efi/secure-boot.c
+++ b/src/boot/efi/secure-boot.c
@@ -67,7 +67,7 @@ static EFI_STATUS set_custom_mode(bool enable) {
                                attr, sizeof(mode), &mode);
 }
 
-EFI_STATUS secure_boot_enroll_at(EFI_FILE *root_dir, const char16_t *path, bool force) {
+EFI_STATUS secure_boot_enroll_at(EFI_FILE *root_dir, const char16_t *path, bool force, bool poweroff) {
         assert(root_dir);
         assert(path);
 
@@ -184,11 +184,21 @@ EFI_STATUS secure_boot_enroll_at(EFI_FILE *root_dir, const char16_t *path, bool
                 }
         }
 
-        printf("Custom Secure Boot keys successfully enrolled, rebooting the system now!\n");
         /* The system should be in secure boot mode now and we could continue a regular boot. But at least
-         * TPM PCR7 measurements should change on next boot. Reboot now so that any OS we load does not end
-         * up relying on the old PCR state. */
-        RT->ResetSystem(EfiResetCold, EFI_SUCCESS, 0, NULL);
+         * TPM PCR7 measurements should change on next boot. Reboot/poweroff now so that any OS we load
+         * does not end up relying on the old PCR state.
+         */
+
+        uint64_t dummy_key;
+        if (poweroff == 1) {
+                printf("Custom Secure Boot keys successfully enrolled, powering of the system now!\n");
+                console_key_read(&dummy_key , 2 * 1000 * 1000); /* wait a bit so user can see the message */
+                RT->ResetSystem(EfiResetShutdown, EFI_SUCCESS, 0, NULL);
+        } else {
+                printf("Custom Secure Boot keys successfully enrolled, rebooting the system now!\n");
+                console_key_read(&dummy_key, 2 * 1000 * 1000); /* wait a bit so user can see the message */
+                RT->ResetSystem(EfiResetCold, EFI_SUCCESS, 0, NULL);
+        }
         assert_not_reached();
 
 out_deallocate:
diff --git a/src/boot/efi/secure-boot.h b/src/boot/efi/secure-boot.h
index 347113135f..3eb9eef006 100644
--- a/src/boot/efi/secure-boot.h
+++ b/src/boot/efi/secure-boot.h
@@ -14,7 +14,7 @@ typedef enum {
 bool secure_boot_enabled(void);
 SecureBootMode secure_boot_mode(void);
 
-EFI_STATUS secure_boot_enroll_at(EFI_FILE *root_dir, const char16_t *path, bool force);
+EFI_STATUS secure_boot_enroll_at(EFI_FILE *root_dir, const char16_t *path, bool force, bool poweroff);
 
 typedef bool (*security_validator_t)(
                 const void *ctx,
