From 48e3bc48a9b06b7b2d33e5cea07181e5a1503453 Mon Sep 17 00:00:00 2001
From: Alex Zenla <alex@edera.dev>
Date: Sat, 26 Sep 2026 18:12:22 -0700
Subject: [PATCH] fix(loader): install the security hook right before LoadImage

The hook was installed before retaining the shim protocol and reading
the image, so an error in either step returned without uninstalling
it. Install it immediately before LoadImage instead.
---
 crates/eficore/src/loader.rs | 22 ++++++++++++----------
 1 file changed, 12 insertions(+), 10 deletions(-)

diff --git a/crates/eficore/src/loader.rs b/crates/eficore/src/loader.rs
index 7958560..16c962f 100644
--- a/crates/eficore/src/loader.rs
+++ b/crates/eficore/src/loader.rs
@@ -83,16 +83,6 @@ impl ImageLoader {
         // If the image loader is installed, we can skip over the security hook.
         let requires_security_hook = secure_boot && shim_loaded && !shim_loader_available;
 
-        // If the security hook is required, we will bail for now.
-        if requires_security_hook {
-            // Install the security hook, if possible. If it's not, this is necessary to continue,
-            // so we should bail.
-            let installed = SecurityHook::install().context("unable to install security hook")?;
-            if !installed {
-                bail!("unable to install security hook required for this platform");
-            }
-        }
-
         // If the shim is loaded, we will need to retain the shim protocol to allow
         // loading multiple images.
         if shim_loaded {
@@ -114,6 +104,18 @@ impl ImageLoader {
             file_path: input.file_path(),
         };
 
+        // If the security hook is required, install it right before loading the image.
+        // Installing it here ensures that an error while preparing the image can't
+        // return without uninstalling the hook.
+        if requires_security_hook {
+            // Install the security hook, if possible. If it's not, this is necessary to continue,
+            // so we should bail.
+            let installed = SecurityHook::install().context("unable to install security hook")?;
+            if !installed {
+                bail!("unable to install security hook required for this platform");
+            }
+        }
+
         // Loads the image using Boot Services LoadImage function.
         let result = uefi::boot::load_image(current_image, source).context("unable to load image");