Hacker News Reader

Thanks. My take is on this is root access -> stealthy bootkit. Further demonstrates "secure" boot and similar DRM is theater only.

View on HN

On the defense of the secure boot illusionists, though, I'm going to imagine that _anyone_ who was actually concerned about secure boot working as intended would have disabled the running kernel from accessing UEFI variables and the UEFI system partition.

AFAIK, while supporting XBOOTLDR, the systemd project still encourages /boot to be on the ESP if possible.

Personally, I don't understand why they advocate this. Beyond separation of concerns and situations like this, it also seems more realistic to advocate for XBOOTLDR style deployments in the face of dual boot systems and Windows creating an anemic ESP nowadays.

> Personally, I don't understand why they advocate this.

It seems easier to explain if you don't mind choosing from a nice range of conspiracy theories about what systemd is and why it has spread like a virus.

> disabled the running kernel from accessing UEFI variables and the UEFI system partition.

How exactly do you propose doing that? I suppose you could see if OPAL can block writes to the ESP, but that does nothing about efi vars.

Kernel lockdown

Reply on news.ycombinator.com