> I personally believe that making use of features in the boot file systems that the firmware environment cannot really make sense of is very clearly not advisa

> I personally believe that making use of features in the boot file systems that the firmware environment cannot really make sense of is very clearly not advisable. The UEFI file system APIs know no symlinks, and what is SELinux to UEFI anyway? Moreover, putting more than the absolute minimum of simple data files into such file systems immediately raises questions about how to authenticate them comprehensively (including all fancy metadata) cryptographically on use It makes all the sense if you want the firmware to load your bootloader binary and then get lost. Firmware is not to be trusted to read, write, interpret, analyze or send your boot file system elsewhere. It's a closed proprietary part of your hardware ffs and unless that changes, it should be kept in dark. When there is hardware with free software firmware we can fix, then we can talk about accomodating firmware vendor needs.