Warning: Some posts on this platform may contain adult material intended for mature audiences only. Viewer discretion is advised. By clicking ‘Continue’, you confirm that you are 18 years or older and consent to viewing explicit content.
Generally yes. For many distros, the kernel signing key is with the distro maintainers and so the package comes with pre-signed kernel images. For distros like Arch and Gentoo, it’s the user’s responsibility to maintain the signing key and sign each updated kernel
The firmware has to allow it, so if you’ve got physical access to the machine that’s possible. Remote access root, on the other hand, can’t tell the firmware to register new keys as long as it’s configured correctly
Generally yes. For many distros, the kernel signing key is with the distro maintainers and so the package comes with pre-signed kernel images. For distros like Arch and Gentoo, it’s the user’s responsibility to maintain the signing key and sign each updated kernel
So why can’t root add new keys?
The firmware has to allow it, so if you’ve got physical access to the machine that’s possible. Remote access root, on the other hand, can’t tell the firmware to register new keys as long as it’s configured correctly