Red Hat Bugzilla – Bug 1304078
systemd should mount efivarfs as read-only by default
Last modified: 2016-02-02 16:42:09 EST
Description of problem:
Given various problems with some motherboard manufacturers' implementations of UEFI, efivarfs is even more fragile than might otherwise be expected for an exposed firmware interface. For this and general safety reasons, efivarfs (if kept mounted at all by default) should be mounted read-only.
Utilities needing to write into it (cf bug 886208) should be responsible for taking steps/getting permissions as needed, or instructing the administrator to remount it in rw mode before continuing.
This may help prevent errant accidents with non-firmware-related commands from causing actual firmware problems.
Upstream bug closed: https://github.com/systemd/systemd/issues/2402
This got closed as WONTFIX upstream no need to carry on with this here...