On Sat, 21 Oct 2017 at 11:51:42 +0200
Didier Kryn <kryn@???> wrote:

> Le 21/10/2017 à 09:58, Arnt Gulbrandsen a écrit :
>> John Franklin writes:
>>> That’s not an apology. Would you like to try again?
>>
>> I'm not Steve, but the occasion fits:
>>
>> Tobias, until I read your posting a couple of days ago I did not
>> realise that UEFI/Secure Boot can be configured such that ONLY my
>> kernels can be booted, not even fresh install media from the vendor.
>> Thank you very much.
>

>      Me neither. Who, in fact? There seems to be a lack of information 
> on that matter. Does anybody have some link to point us?

In fact that's impossible to UEFI, as it's designed to check only on the
bootloader's first stage, which is the only binary it knows about, nothing
that is loaded after it (bootloader second stage, kernel, init and so forth).


Alessandro