From: Jeremy Cline on gitlab.com https://gitlab.com/cki-project/kernel-ark/-/merge_requests/3862#note_2495453718
I spent some time examining what other distributions are doing, and I like Debian's approach which is to put this call (behind the `CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT` config) in the `efi_set_secure_boot` function. It also moves the call to `efi_set_secure_boot` (and the machinery to read the SB state) into `efi_init`. That way each arch-specific setup just needs to call `efi_init()`. It's nice because the lockdown mode is set in a single place. I also think it would be good to minimize the differences between distributions since we're all maintaining similar downstream patches. @msalter, what do you think? [The Debian patch set, for reference](https://salsa.debian.org/kernel- team/linux/-/tree/debian/latest/debian/patches/features/all/lockdown). -- _______________________________________________ kernel mailing list -- [email protected] To unsubscribe send an email to [email protected] Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/[email protected] Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
