Description of problem:

Given various problems with some motherboard manufacturers' implementations of UEFI, efivarfs is even more fragile than might otherwise be expected for an exposed firmware interface. For this and general safety reasons, efivarfs (if kept mounted at all by default) should be mounted read-only.

Utilities needing to write into it (cf bug 886208) should be responsible for taking steps/getting permissions as needed, or instructing the administrator to remount it in rw mode before continuing. 

This may help prevent errant accidents with non-firmware-related commands from causing actual firmware problems.


Additional info:
Upstream bug closed: https://github.com/systemd/systemd/issues/2402

https://github.com/systemd/systemd/blob/master/src/core/mount-setup.c#L109