# NOTE: I had to use the paxctl command to disable protections on
# /usr/sbin/grub-probe and /usr/bin/grub-script-check
# because I found that PAX was killing update-grub (which is run
# by /etc/kernel/postinst.d/zz-update-grub after kernel install)