DKMS taints the kernel in most setups and also requires secure boot in most contexts, disabling lock down mode and disabling most protections in the first place. If you use DKMS (to use the Nvidia driver, for example), the security boundary between root and kernel is basically nonexistent.
I’d love to see distros guide users to setting up secure boot properly (with custom certificates so Linux can be booted securely) but in practice most distros don’t have this protection boundary.
depends, they can also loaded via dkms which may not require it
DKMS taints the kernel in most setups and also requires secure boot in most contexts, disabling lock down mode and disabling most protections in the first place. If you use DKMS (to use the Nvidia driver, for example), the security boundary between root and kernel is basically nonexistent.
I’d love to see distros guide users to setting up secure boot properly (with custom certificates so Linux can be booted securely) but in practice most distros don’t have this protection boundary.
It kinda depends, on custom kernels DKMS can be incredibly helpful. Like for a hardened kernel, a lot of drivers may be loaded via DKMS.