> disabled the running kernel from accessing UEFI variables and the UEFI system partition. How exactly do you propose doing that? I suppose you could see if O

> disabled the running kernel from accessing UEFI variables and the UEFI system partition. How exactly do you propose doing that? I suppose you could see if OPAL can block writes to the ESP, but that does nothing about efi vars.