4 ms·
Could be a job for SELinux. Most of the files in efivars don't ever need modifying. So SELinux could make all files unmodifiable by default, and allow modificat
by cmurf 11y ago
Could be a job for SELinux. Most of the files in efivars don't ever need modifying. So SELinux could make all files unmodifiable by default, and allow modification of the few that are needed by efibootmgr.
- snuxoll 11y agoUnless you set SELinux to run in strict mode root still has access to delete everything.