[coreboot] Locking coreboot against internal flashing

[Frank Beuth]

On Thu, Feb 14, 2019 at 12:21:36PM -0500, Matt B wrote:
> For Coreboot afaik the only two methods available are to flash with a
> programmer or to flash internally from linux with iomem=relaxed.

On another mailing list, someone commented "I would never use Coreboot, because 
it would let malware flash your bios from within Linux." (paraphrased)

I'm reasonably sure that this is not true and security-conscious users can 
disable internal flashing, but I haven't been able to find any mention of such 
a setting in the documentation.

How can users disable internal flashing?