3 ms·
I believe it's a set of kernel build flags and not a kernel parameter, in which case, not really, I initially said you could just replace the kernel with someth
by diath 7y ago
I believe it's a set of kernel build flags and not a kernel parameter, in which case, not really, I initially said you could just replace the kernel with something that's been built without the flags and reboot but apparently the second paragraph says it prevents that, though I'm not sure how would updating the kernel work in that case then.
- rrss 7y agoThere are build config options, but there's also a kernel parameter > lockdown= [SECURITY] { integrity | confidentiality } https://www.kernel.org/doc/Documentation/admin-guide/kernel-parameters.txt https://www.kernel.org/doc/Documentation/admin-guide/kernel-...
- diath 7y agoI missed that part, so I'm honestly as puzzled as you are (I suppose the answer would be yes then).
- Spivak 7y agoYou need GRUB's help do do this. There is a 'verify' module you can use that makes GRUB load files that are signed with a given GPG key. You build a GRUB efi binary that contains your key and only loads signed config files, initrds, and kernels and then sign that binary so that it can be loaded by UEFI.