> tl;dr: I think changing everything to 0600 is probably completely fine,
> and whitelisting is probably pointless.
But do you speak for all users? It will just take one person complaining
that efibootmgr no longer shows them what it used to show to bring down
the wrath of Linus on our (specifically Joe's) head for breaking user space.
I've got someone about to start looking at making efivarfs read and save
the values during mount, so all the read-only options can continue to work
without making EFI calls.
This will cost some memory (say 20-30 variables at up to 1K each).
-Tony
��.n��������+%������w��{.n�����{����* jg��� �����ݢj����G���� ���j:+v���w�m������w�������h�����٥
