Bug 1304078 - systemd should mount efivarfs as read-only by default
systemd should mount efivarfs as read-only by default
Status: CLOSED WONTFIX
Product: Fedora
Classification: Fedora
Component: systemd (Show other bugs)
rawhide
Unspecified Unspecified
unspecified Severity medium
: ---
: ---
Assigned To: systemd-maint
Fedora Extras Quality Assurance
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2016-02-02 14:54 EST by Japheth Cleaver
Modified: 2016-02-02 16:42 EST (History)
7 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2016-02-02 16:42:09 EST
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Japheth Cleaver 2016-02-02 14:54:17 EST
Description of problem:

Given various problems with some motherboard manufacturers' implementations of UEFI, efivarfs is even more fragile than might otherwise be expected for an exposed firmware interface. For this and general safety reasons, efivarfs (if kept mounted at all by default) should be mounted read-only.

Utilities needing to write into it (cf bug 886208) should be responsible for taking steps/getting permissions as needed, or instructing the administrator to remount it in rw mode before continuing. 

This may help prevent errant accidents with non-firmware-related commands from causing actual firmware problems.


Additional info:
Upstream bug closed: https://github.com/systemd/systemd/issues/2402

https://github.com/systemd/systemd/blob/master/src/core/mount-setup.c#L109
Comment 1 Jóhann B. Guðmundsson 2016-02-02 16:42:09 EST
This got closed as WONTFIX upstream no need to carry on with this here...

Note You need to log in before you can comment on or make changes to this bug.