4 ms·
There are build config options, but there's also a kernel parameter > lockdown= [SECURITY] { integrity | confidentiality } https://www.kernel.org/doc/Docu
by rrss 6y ago
There are build config options, but there's also a kernel parameter
> lockdown= [SECURITY]
{ integrity | confidentiality }
https://www.kernel.org/doc/Documentation/admin-guide/kernel-parameters.txt https://www.kernel.org/doc/Documentation/admin-guide/kernel-...
- diath 6y agoI missed that part, so I'm honestly as puzzled as you are (I suppose the answer would be yes then).
- Spivak 6y agoYou need GRUB's help do do this. There is a 'verify' module you can use that makes GRUB load files that are signed with a given GPG key. You build a GRUB efi binary that contains your key and only loads signed config files, initrds, and kernels and then sign that binary so that it can be loaded by UEFI.