The EFI spec is a horrible disastrous mess, but in theory you could be reading and writing EFIvars at runtime to dynamically configure boots - ie, &quot;reboot to safe mode&quot; would set the evifar next boot parameter to your initram-fs fallback. It would not be complicated to implement pam &#x2F; polkit support for unprivlidged users to set such things without authenticating root.<p>It does not change the fact the fault lies with shitty proprietary UEFI implementations, and nobody writing free software is at fault here.