Systemd mounted efivarfs read-write, allowing motherboard bricking via 'rm'

Re:Systemd mounted efivarfs read-write, allowing motherboard... by snuxoll on Saturday January 30, 2016 @03:38AM (#11001130)

Did Lennart have anything to do with the actual efivars implementation in the kernel? If so, then yeah, shame on him by all means. I agree it's a broken abstraction, but it's what the kernel developers decided on (and they sure like making system configuration available with filesystems, see sysfs and procfs).

Ultimately access is needed to even configure the bootloader, and right now that means it needs to be mounted RW. Let's go yell at the kernel developers instead of taking it out on systemd for using a virtual filesystem instead of a syscall.

[ Parent | on HN ]

Re:Systemd mounted efivarfs read-write, allowing motherboard... by icebraining on Sunday January 31, 2016 @06:49PM (#11008734)

By the way, here's the author of the kernel module in question, talking about this issue:

https://twitter.com/mjg59/status/693494314941288448

[ Parent | on HN ]

Re:Systemd mounted efivarfs read-write, allowing motherboard... by snuxoll on Monday February 01, 2016 @12:34PM (#11013374)

I'm really glad he's speaking out on the issue, Matt is a smart guy (I used to talk with him frequently on IRC) and it's sad to see many of the same people trying to act like they know better than him in that twitter thread. There's no easy fix to this issue, and regardless of whether an rm -rf / can hose your system there's bigger issues at stake with malicious actors that a stupid bandaid like that won't fix.

[ Parent | on HN ]

Re:Systemd mounted efivarfs read-write, allowing motherboard... by digi_owl on Saturday January 30, 2016 @10:14AM (#11002068)

Here is the thing, one day systemd overrides a kernel default without warning because of "best practices", another day they leave it alone even if it is basically a cocked gun aimed at the admins foot.

[ Parent | on HN ]