Closed jsetje closed 2 years ago
Since booting from removable media can be hard to detect, setting a persistent latest SBAT policy is risky in a typical client system. This changes latest to be a one-shot operation that could be set at the time of an OS update if desired.
I've pushed the fix as https://github.com/rhboot/shim/commit/77144e5a404df89b45941bfc54fd2f59e0ee607b
Since booting from removable media can be hard to detect, setting a persistent latest SBAT policy is risky in a typical client system. This changes latest to be a one-shot operation that could be set at the time of an OS update if desired.