The kernel isn&#x27;t in charge of mount options, that&#x27;s the job of userspace (generally an init system). In any case, you would end up needing a way to mount it RW to accommodate legit uses of the non-broken EFI vars, at which point you&#x27;re back where you started. This fix addresses it by having the kernel identify and protect only broken (or at least, non-standard) EFI vars.