Systemd mounted efivarfs read-write, allowing motherboard bricking via 'rm'

Re:Systemd mounted efivarfs read-write, allowing motherboard... by snuxoll on Saturday January 30, 2016 @03:19AM (#11001084)

I agree with you, but then we delve into the fun of needing to implement a syscall for this or a something in sysfs that limits the damage that can be done. I suppose it's better than the current efivars filesystem, but neither is a wonderful solution when we have to limit access to the hardware that could potentially do useful things (without patching the kernel, of course).

[ Parent | on HN ]

Re:Systemd mounted efivarfs read-write, allowing motherboard... by Sanddancer on Saturday January 30, 2016 @12:55PM (#11002871)

It's useful, yes, but because of the buggy implementations out there, the risk in bricking, wanton removal of important variables, etc, is just too great. If anything, it should be a device node or the like. /dev/efi makes a lot more sense given its structure and purpose than trying to abstract it into looking kinda sorta like a filesystem.

[ Parent | on HN ]

Re:Systemd mounted efivarfs read-write, allowing motherboard... by snuxoll on Saturday January 30, 2016 @01:09PM (#11002938)

My big problem at the end of the day is while we can help prevent users from killing their own boards - we still NEED to be holding these firmware vendors accountable. No matter what abstraction is presented to user space once someone has root on my system they could potentially destroy my hardware.

Maybe one there is some nasty Windows Virus out there that fries boards by deleting EFI variables these stupid vendors will get their shit in order.

[ Parent | on HN ]