On Wed, May 10, 2023 at 11:37:34AM -0500, Chris Adams wrote:
Once upon a time, Daniel P. Berrangé <berrange(a)redhat.com>
said:
> If the idea to allow a UKI to contain multiple alternate, signed,
> cmdline line profiles gets accepted
Are those of us who need boot-time kernel options (e.g. for hardware
workarounds or such) just screwed in the signed command-line cases?
Today yes, but in future no. There's very active ongoing discussion
and coding to sort out how to securely allow local customization
of kernel command lines. Note, I said "local customization", I didn't
say "arbitrary interactive override at boot time". IOW, the way it is
achieved will probably look different to what we're used to historically.
Some form of local deployment level customization is clearly critical if
UKIs are to be viable beyond tightly constrained deployment scenarios.
Hardware specific workarounds is one use case that needs to be supported.
If you want to learn more, the systemd ticket I linked to in my mail
has all the discussion (sorry, a very long read, I know) and links to
pull requests where relevant.
With regards,
Daniel
--
|:
https://berrange.com -o-
https://www.flickr.com/photos/dberrange :|
|:
https://libvirt.org -o-
https://fstop138.berrange.com :|
|:
https://entangle-photo.org -o-
https://www.instagram.com/dberrange :|