From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751416AbcBOKuJ (ORCPT ); Mon, 15 Feb 2016 05:50:09 -0500 Received: from mail-wm0-f52.google.com ([74.125.82.52]:37519 "EHLO mail-wm0-f52.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750925AbcBOKuH (ORCPT ); Mon, 15 Feb 2016 05:50:07 -0500 Date: Mon, 15 Feb 2016 10:50:04 +0000 From: Matt Fleming To: Ingo Molnar , Thomas Gleixner , "H . Peter Anvin" Cc: Ard Biesheuvel , Peter Jones , linux-kernel@vger.kernel.org, linux-efi@vger.kernel.org, "Lee, Chun-Yi" , Matthew Garrett , Laszlo Ersek Subject: Re: [PATCH 5/5] efi: Make efivarfs entries immutable by default Message-ID: <20160215105004.GC2591@codeblueprint.co.uk> References: <1455276432-9931-1-git-send-email-matt@codeblueprint.co.uk> <1455276432-9931-6-git-send-email-matt@codeblueprint.co.uk> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1455276432-9931-6-git-send-email-matt@codeblueprint.co.uk> User-Agent: Mutt/1.5.24+41 (02bc14ed1569) (2015-08-30) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Fri, 12 Feb, at 11:27:12AM, Matt Fleming wrote: > From: Peter Jones > > "rm -rf" is bricking some peoples' laptops because of variables being > used to store non-reinitializable firmware driver data that's required > to POST the hardware. > > These are 100% bugs, and they need to be fixed, but in the mean time it > shouldn't be easy to *accidentally* brick machines. > > We have to have delete working, and picking which variables do and don't > work for deletion is quite intractable, so instead make everything > immutable by default (except for a whitelist), and make tools that > aren't quite so broad-spectrum unset the immutable flag. > > Signed-off-by: Peter Jones > Tested-by: "Lee, Chun-Yi" > Acked-by: Matthew Garrett > Signed-off-by: Matt Fleming > --- > Documentation/filesystems/efivarfs.txt | 7 +++ > drivers/firmware/efi/vars.c | 87 +++++++++++++++++++------- > fs/efivarfs/file.c | 70 +++++++++++++++++++++ > fs/efivarfs/inode.c | 30 +++++---- > fs/efivarfs/internal.h | 3 +- > fs/efivarfs/super.c | 9 ++- > include/linux/efi.h | 2 + > tools/testing/selftests/efivarfs/efivarfs.sh | 19 +++++- > tools/testing/selftests/efivarfs/open-unlink.c | 72 ++++++++++++++++++++- > 9 files changed, 258 insertions(+), 41 deletions(-) Folks, please hold off on merging this patch as Laszlo has raised a good point about including the efi-pstore variables in the whitelist.