On Wed, Apr 4, 2018 at 9:09 AM Linus Torvalds <torvalds@xxxxxxxxxxxxxxxxxxxx> wrote: > On Tue, Apr 3, 2018 at 9:30 PM, Matthew Garrett <mjg59@xxxxxxxxxx> wrote: > > > > Bear in mind that I'm talking about defaults here > Mattyhew, I really want you to look yourself in the mirror. > Those defaults are really horrible defautls for real technical reasons. > You asked me why when I questioned this, but then when I replied, you > entirely ignored it. > So let me repeat: the defaults are *horrible*. They are horrible for a > very simple reason: kernel behavior changes that depend on some subtle > boot difference are truly nasty to debug, and nasty to get coverage > for. They're the defaults that the mainline distros have been shipping for years. So what are you actually asking for here? If you're saying that it should be possible to enable the lockdown functionality even in the absence of any kind of verified boot, then yes, I agree - I just think it makes a poor distro default to have that be the case out of the box. If you're saying that it should be possible to disable the lockdown functionality even in the presence of any kind of verified boot, then yes, I agree - I just think it makes a poor distro default to have that be the case out of the box. You're arguing against a patch that provides the default policy that distros want to ship. -- To unsubscribe from this list: send the line "unsubscribe linux-api" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
