I think you are mistaken about some of the details here.  We are talking about root being able to write to efivarfs, which is needed for some valid reasons.  Unfortunately, there are firmware implementations out there that don&#x27;t handle some variables being overridden&#x2F;wiped, and it bricks the system.  So, the problem is bad firmware, exacerbated by the choice to represent EFI variable as a filesystem and what happens when you do a &quot;rm -rf &#x2F;&quot; (in the simplest example).  So, in my eyes, root <i>should</i> be able to write to efivarfs when needed, but we should mitigate this problem in some way so it&#x27;s hard to accidentally brick your system by making it a little <i>harder</i> (but not impossible) for root to write to this filesystem.  It&#x27;s not possible to allow root to write to EFI while still ensuring that it can&#x27;t brick the machine, because the responsibility for that capability lies with the firmware developers.