Why not just turn off recognition of &quot;rm&quot; in the efivarfs? That is, the response to &quot;unlink&quot; of a file that represents a system abstraction of firmware should be something drastic only to the unlinker. SIGSEGV or something. &quot;Go away, don&#x27;t do that.&quot;