diff options
| author | Peter Jones <pjones@redhat.com> | 2016-02-08 14:48:15 -0500 |
|---|---|---|
| committer | Sasha Levin <sasha.levin@oracle.com> | 2016-04-11 22:44:23 -0400 |
| commit | 3e49b9ec16de14ec3210e87c4307ffdb75cfe0b0 (patch) | |
| tree | 5fa6940340bd6d672ef22b9470dd9bc46b2d4850 /Documentation | |
| parent | c3f517d4cd9a1478ae99f873697444a8690de482 (diff) | |
efi: Make efivarfs entries immutable by default
[ Upstream commit ed8b0de5a33d2a2557dce7f9429dca8cb5bc5879 ]
"rm -rf" is bricking some peoples' laptops because of variables being
used to store non-reinitializable firmware driver data that's required
to POST the hardware.
These are 100% bugs, and they need to be fixed, but in the mean time it
shouldn't be easy to *accidentally* brick machines.
We have to have delete working, and picking which variables do and don't
work for deletion is quite intractable, so instead make everything
immutable by default (except for a whitelist), and make tools that
aren't quite so broad-spectrum unset the immutable flag.
Signed-off-by: Peter Jones <pjones@redhat.com>
Tested-by: Lee, Chun-Yi <jlee@suse.com>
Acked-by: Matthew Garrett <mjg59@coreos.com>
Signed-off-by: Matt Fleming <matt@codeblueprint.co.uk>
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
Diffstat (limited to 'Documentation')
| -rw-r--r-- | Documentation/filesystems/efivarfs.txt | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/Documentation/filesystems/efivarfs.txt b/Documentation/filesystems/efivarfs.txt index c477af086e65..686a64bba775 100644 --- a/Documentation/filesystems/efivarfs.txt +++ b/Documentation/filesystems/efivarfs.txt @@ -14,3 +14,10 @@ filesystem. efivarfs is typically mounted like this, mount -t efivarfs none /sys/firmware/efi/efivars + +Due to the presence of numerous firmware bugs where removing non-standard +UEFI variables causes the system firmware to fail to POST, efivarfs +files that are not well-known standardized variables are created +as immutable files. This doesn't prevent removal - "chattr -i" will work - +but it does prevent this kind of failure from being accomplished +accidentally. |