On Wed, May 10, 2023 at 11:37:34AM -0500, Chris Adams wrote: > Once upon a time, Daniel P. Berrangé <berra...@redhat.com> said: > > If the idea to allow a UKI to contain multiple alternate, signed, > > cmdline line profiles gets accepted > > Are those of us who need boot-time kernel options (e.g. for hardware > workarounds or such) just screwed in the signed command-line cases?
Today yes, but in future no. There's very active ongoing discussion and coding to sort out how to securely allow local customization of kernel command lines. Note, I said "local customization", I didn't say "arbitrary interactive override at boot time". IOW, the way it is achieved will probably look different to what we're used to historically. Some form of local deployment level customization is clearly critical if UKIs are to be viable beyond tightly constrained deployment scenarios. Hardware specific workarounds is one use case that needs to be supported. If you want to learn more, the systemd ticket I linked to in my mail has all the discussion (sorry, a very long read, I know) and links to pull requests where relevant. With regards, Daniel -- |: https://berrange.com -o- https://www.flickr.com/photos/dberrange :| |: https://libvirt.org -o- https://fstop138.berrange.com :| |: https://entangle-photo.org -o- https://www.instagram.com/dberrange :| _______________________________________________ devel mailing list -- devel@lists.fedoraproject.org To unsubscribe send an email to devel-le...@lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
