News for hackers. Stuff that matters.
Re:Systemd mounted efivarfs read-write, allowing motherboard... by jerf on Friday January 29, 2016 @08:56PM (#11000119)
(Honest question, I lack hardware to check this on myself:) What do non-systemd systems do about this?
Re:Systemd mounted efivarfs read-write, allowing motherboard... by Sanddancer on Friday January 29, 2016 @09:22PM (#11000189)
FreeBSD has an efi library that's used in early boot to handle this instead. To be honest, with the structure of UEFI, exposing it as a filesystem is problematic at best. A filesystem just hides too much data from you -- errors, the reason a call to setting a variable failed, etc. Not everything is a file, and shoehorning things in to try to pretend just doesn't work.
Re:Systemd mounted efivarfs read-write, allowing motherboard... by bitwize on Saturday January 30, 2016 @02:59AM (#11001033)
Indeed. It should be exposed the standard way you expose functionality in Linux -- with a D-Bus API.
Re:Systemd mounted efivarfs read-write, allowing motherboard... by simoncion on Saturday January 30, 2016 @02:42AM (#11000984)
If I had a system that I booted in UEFI mode, I could tell you, but all of my hardware (even the ones running UEFI) boot OSs in BIOS mode.

Despite the fact that they're primarily a systemd distro, Arch Linux strongly recommends that you mount efivarfs in ro mode and remount rw when doing kernel upgrades.

GRUB2 seems to use efibootmgr to write stuff to EFI, and efibootmgr appears to lack a "detect if efivarfs is mounted ro and temporarily mount it rw" switch, so you have to do that manually too.

Gentoo's Genkernel-next doesn't seem to do anything at all with EFI.

Dracut (one of RedHat's initrd management tools) looks like it reads from efivarfs, but does not write to it. (But there's a lot of code in Dracut, so it's entirely possible I missed something.)

It's not entirely clear to me that you can't use BIOS boot with a GPT-formatted disk if your bootloader supports that sort of thing. It's also not clear to me whether or not chainloading from GRUB into Windows is supported with a BIOS/GPT partitioning scheme.

Regardless, it's a pity that the UEFI design committee apparently thought that requiring one to write data into the motherboard's persistent storage in order to boot into a OS was a reasonable thing to do.

Re:Systemd mounted efivarfs read-write, allowing motherboard... by JoshTriplett on Saturday January 30, 2016 @03:30AM (#11001115)
> Despite the fact that they're primarily a systemd distro, Arch Linux strongly recommends that you mount efivarfs in ro mode and remount rw when doing kernel upgrades.

Why not leave it unmounted entirely, and only mount it when installing new boot entries?

Re:Systemd mounted efivarfs read-write, allowing motherboard... by simoncion on Saturday January 30, 2016 @04:10AM (#11001194)
> Why not leave it unmounted entirely, and only mount it when installing new boot entries?

Because there are -presumably- reasons to read EFI variables? If they're exposed through efivarsfs, then it's a convenient way to access them.

Re:Systemd mounted efivarfs read-write, allowing motherboard... by snuxoll on Saturday January 30, 2016 @01:32PM (#11003073)
A traditional BIOS or UEFI running in CSM requires an MBR formatted disk since the bootloader must be started from the first 512 bytes on disk. I have to boot ESXi on my ProLiant ML10 off a flash drive because my 3TB disk would become a 2TB disk otherwise.
Re:Systemd mounted efivarfs read-write, allowing motherboard... by intelfx on Saturday January 30, 2016 @07:04PM (#11004460)
Did you hear about "hybrid MBR"?
Re:Systemd mounted efivarfs read-write, allowing motherboard... by snuxoll on Monday February 01, 2016 @01:41PM (#11014122)
Hybrid MBR is an extremely fragile and hackish technique to make crappy old firmware boot larger disks. In general I want my whole 3TB drive allocated to VM storage instead of partitioning it up so ESXi has somewhere to live, so just running that off an easily replaceable USB key is a lot simpler to maintain.
Re:Systemd mounted efivarfs read-write, allowing motherboard... by gtrubetskoy on Saturday January 30, 2016 @01:35AM (#11000828)
FreeBSD generally avoids system calls via filesystem - it's cute because you can change kernel parameters with echo and cat, but it's generally not efficient and prone to unexpected problems such as what this whole thread is about. You can just use appropriate commands which in turn use the appropriate system calls to accomplish the same thing.
Re:Systemd mounted efivarfs read-write, allowing motherboard... by edwintorok on Saturday January 30, 2016 @03:21AM (#11001089)
I got the efi vars in /sys/firmware/efi/vars on a Debian witht sysvinit boot (but cgmanager and systemd-login), and its mounted rw as default.