From: Mike Gilbert <floppym@gentoo.org>
To: Gentoo Dev <gentoo-dev@lists.gentoo.org>
Subject: Re: [gentoo-dev] newsitem: openrc-0.28 mounts efivars read only
Date: Thu, 13 Jul 2017 12:47:00 -0400 [thread overview]
Message-ID: <CAJ0EP43DOHi4266M-RBi33SQY46NqB=JSsN1yvz3+-QLcKhrtQ@mail.gmail.com> (raw)
In-Reply-To: <CAJ0EP42=+=jicVd+Qk_oy1MHs4qk+EXXC6gwUApMhaR50r=jvA@mail.gmail.com>
On Thu, Jul 13, 2017 at 12:45 PM, Mike Gilbert <floppym@gentoo.org> wrote:
> On Thu, Jul 13, 2017 at 10:58 AM, Andrew Savchenko <bircoph@gentoo.org> wrote:
>> On Thu, 13 Jul 2017 10:29:06 -0400 Mike Gilbert wrote:
>>> On Thu, Jul 13, 2017 at 7:35 AM, M. J. Everitt <m.j.everitt@iee.org> wrote:
>>> > On 13/07/17 12:09, Rich Freeman wrote:
>>> >> Presumably you'd only want to remount it if it was mounted ro to
>>> >> start, since it sounds like openrc will be diverging from systemd
>>> >> behavior here.
>>> >>
>>> >> While it seems like a good idea I'm not sure how big an improvement it
>>> >> is in the larger scheme. We're worried about root accidentially
>>> >> modifying efivars, but we have no safeguards against root writing to
>>> >> /dev/sda, and the latter seems much more likely to cause harm, and is
>>> >> harder to fix.
>>> >>
>>> > In case you weren't aware, Rich, rewriting the efivars actually writes
>>> > to the system BIOS, which renders the computer completely unbootable ..
>>> > not quite the same as erasing the boot sector of your hard disk, where
>>> > you simply plug in another device, and Off you go ...
>>> >
>>>
>>> We are actually talking about protecting people who run something like
>>> rm -rf /sys/firmware/efi/efivars/ as root.
>>>
>>> If you are dumb enough to do something like that, you almost deserve
>>> to spend a couple hundred on a new motherboard.
>>
>> Or just rm -rf /
>> [pedantic]
>> of course with newer rm versions one needs to run:
>> rm -rf --no-preserve-root /
>> or
>> rm -rf /* /.*
>> [/pedantic]
>>
>> But in some scenarios this command is normal. E.g. user installs
>> Gentoo from some live dvd/flash, makes some mistakes, understands
>> that system is broken beyond repair and decides to start over again.
>> If there is no need to recreate filesystem itself or partition
>> layout, running rm -rf / as above is quite reasonable.
>>
>> When running this command user expects to kill the data, but not
>> the hardware. That is my point. I can't call such action dumb.
>>
>> Best regards,
>> Andrew Savchenko
>
> Point taken.
>
> Although, if the user is in the process of installing Gentoo, efivarfs
> is likely to be mounted rw anyway so that the user can install a boot
> loader. Having grub-install perform the remount would minimize this
> small risk I suppose.
s/grub-install/efibootmgr/; grub-install does not update efivarfs
directly, but rather calls efibootmgr to do it.
next prev parent reply other threads:[~2017-07-13 16:47 UTC|newest]
Thread overview: 30+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-07-12 15:42 [gentoo-dev] newsitem: openrc-0.28 mounts efivars read only William Hubbs
2017-07-12 15:50 ` M. J. Everitt
2017-07-12 20:03 ` Mike Gilbert
2017-07-12 21:44 ` William Hubbs
2017-07-12 23:04 ` Matt Turner
2017-07-13 0:29 ` Lucas Ramage
2017-07-13 0:42 ` Matt Turner
2017-07-13 1:27 ` Lucas Ramage
2017-07-13 6:30 ` Andrew Savchenko
2017-07-13 11:09 ` Rich Freeman
2017-07-13 11:35 ` M. J. Everitt
2017-07-13 12:17 ` Andrew Savchenko
2017-07-13 14:29 ` Mike Gilbert
2017-07-13 14:35 ` Ben Kohler
2017-07-13 14:58 ` Andrew Savchenko
2017-07-13 15:06 ` Andrew Savchenko
2017-07-13 15:40 ` Rich Freeman
2017-07-13 16:45 ` Mike Gilbert
2017-07-13 16:47 ` Mike Gilbert [this message]
2017-07-13 11:43 ` Andrew Savchenko
2017-07-13 11:54 ` Rich Freeman
2017-07-13 12:14 ` Andrew Savchenko
2017-07-13 12:45 ` Rich Freeman
2017-07-13 2:38 ` Mike Gilbert
2017-07-14 0:09 ` DarKRaveR
2017-07-14 11:02 ` Lucas Ramage
2017-07-13 10:30 ` Kristian Fiskerstrand
2017-07-13 13:52 ` William Hubbs
2017-07-13 23:30 ` William Hubbs
[not found] ` <CAJ0EP434FLFWQCTTqNr16oij=VfYem4ARr+C_-9NoQPBucWKmw@mail.gmail.com>
2017-07-14 0:05 ` Mike Gilbert
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CAJ0EP43DOHi4266M-RBi33SQY46NqB=JSsN1yvz3+-QLcKhrtQ@mail.gmail.com' \
--to=floppym@gentoo.org \
--cc=gentoo-dev@lists.gentoo.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox