[PATCH] Add fwupdate and Mok GUID's to the EFI variable immutable whitelist

[PATCH] Add fwupdate and Mok GUID's to the EFI variable immutable whitelist

[Mario Limonciello]

ed8b0de5a33d2a2557dce7f9429dca8cb5bc5879 caused all variables to be
immutable by default.  This causes problems with userspace applications
mokutil and fwupdate.
---
 drivers/firmware/efi/vars.c | 2 ++
 include/linux/efi.h         | 8 ++++++++
 2 files changed, 10 insertions(+)

diff --git a/drivers/firmware/efi/vars.c b/drivers/firmware/efi/vars.c
index 0ac594c..16bd2a9 100644
--- a/drivers/firmware/efi/vars.c
+++ b/drivers/firmware/efi/vars.c
@@ -199,6 +199,8 @@ static const struct variable_validate variable_validate[] = {
 	{ EFI_GLOBAL_VARIABLE_GUID, "PlatformLang", validate_ascii_string },
 	{ EFI_GLOBAL_VARIABLE_GUID, "Timeout", validate_uint16 },
 	{ LINUX_EFI_CRASH_GUID, "*", NULL },
+	{ FWUPDATE_GUID, "fwupdate*", NULL },
+	{ MOK_GUID, "Mok*", NULL },
 	{ NULL_GUID, "", NULL },
 };
 
diff --git a/include/linux/efi.h b/include/linux/efi.h
index 1626474..c882cb0 100644
--- a/include/linux/efi.h
+++ b/include/linux/efi.h
@@ -575,6 +575,14 @@ void efi_native_runtime_setup(void);
 	EFI_GUID(0x8be4df61, 0x93ca, 0x11d2, \
 		 0xaa, 0x0d, 0x00, 0xe0, 0x98, 0x03, 0x2b, 0x8c)
 
+#define FWUPDATE_GUID \
+	EFI_GUID(0x0abba7dc, 0xe516, 0x4167, \
+		 0xbb, 0xf5, 0x4d, 0x9d, 0x1c, 0x73, 0x94, 0x16)
+
+#define MOK_GUID \
+	EFI_GUID(0x605dab50, 0xe046, 0x4300, \
+		 0xab, 0xb6, 0x3d, 0xd8, 0x10, 0xdd, 0x8b, 0x23)
+
 #define UV_SYSTEM_TABLE_GUID \
 	EFI_GUID(0x3b13a7d4, 0x633e, 0x11dd, \
 		 0x93, 0xec, 0xda, 0x25, 0x56, 0xd8, 0x95, 0x93)
-- 
2.7.3

Re: [PATCH] Add fwupdate and Mok GUID's to the EFI variable immutable whitelist

[Mario Limonciello]

On 03/22/2016 04:37 PM, Limonciello, Mario wrote:
> ed8b0de5a33d2a2557dce7f9429dca8cb5bc5879 caused all variables to be
> immutable by default.  This causes problems with userspace applications
> mokutil and fwupdate.
> ---
>  drivers/firmware/efi/vars.c | 2 ++
>  include/linux/efi.h         | 8 ++++++++
>  2 files changed, 10 insertions(+)
>
> diff --git a/drivers/firmware/efi/vars.c b/drivers/firmware/efi/vars.c
> index 0ac594c..16bd2a9 100644
> --- a/drivers/firmware/efi/vars.c
> +++ b/drivers/firmware/efi/vars.c
> @@ -199,6 +199,8 @@ static const struct variable_validate variable_validate[] = {
>  	{ EFI_GLOBAL_VARIABLE_GUID, "PlatformLang", validate_ascii_string },
>  	{ EFI_GLOBAL_VARIABLE_GUID, "Timeout", validate_uint16 },
>  	{ LINUX_EFI_CRASH_GUID, "*", NULL },
> +	{ FWUPDATE_GUID, "fwupdate*", NULL },
> +	{ MOK_GUID, "Mok*", NULL },
>  	{ NULL_GUID, "", NULL },
>  };
>  
> diff --git a/include/linux/efi.h b/include/linux/efi.h
> index 1626474..c882cb0 100644
> --- a/include/linux/efi.h
> +++ b/include/linux/efi.h
> @@ -575,6 +575,14 @@ void efi_native_runtime_setup(void);
>  	EFI_GUID(0x8be4df61, 0x93ca, 0x11d2, \
>  		 0xaa, 0x0d, 0x00, 0xe0, 0x98, 0x03, 0x2b, 0x8c)
>  
> +#define FWUPDATE_GUID \
> +	EFI_GUID(0x0abba7dc, 0xe516, 0x4167, \
> +		 0xbb, 0xf5, 0x4d, 0x9d, 0x1c, 0x73, 0x94, 0x16)
> +
> +#define MOK_GUID \
> +	EFI_GUID(0x605dab50, 0xe046, 0x4300, \
> +		 0xab, 0xb6, 0x3d, 0xd8, 0x10, 0xdd, 0x8b, 0x23)
> +
>  #define UV_SYSTEM_TABLE_GUID \
>  	EFI_GUID(0x3b13a7d4, 0x633e, 0x11dd, \
>  		 0x93, 0xec, 0xda, 0x25, 0x56, 0xd8, 0x95, 0x93)
Actually, I think this patch should be discarded unless there is a
desire to make the kernel work with older userspace tools. 

I later realized that efivar 0.22 will actually handle working with
immutable variables properly.  This means that mokutil 0.2 won't work
with this kernel commit, but mokutil 0.3 which uses efivar
(https://github.com/lcp/mokutil/commit/7b49e834284659527c9f7cf554f223748c00564b)
should work properly.

fwupdate works properly in most instances except for an install time
cleanup script that removes stale variables.  This is fixed with a
trivial change:
https://github.com/rhinstaller/fwupdate/pull/50/commits/535d3a0f9c096d452cc7e2b5be79cf964e2d6d5b

Re: [PATCH] Add fwupdate and Mok GUID's to the EFI variable immutable whitelist

[Matt Fleming]

On Tue, 22 Mar, at 09:36:25PM, Mario Limonciello wrote:
>
> Actually, I think this patch should be discarded unless there is a
> desire to make the kernel work with older userspace tools. 
> 
> I later realized that efivar 0.22 will actually handle working with
> immutable variables properly.  This means that mokutil 0.2 won't work
> with this kernel commit, but mokutil 0.3 which uses efivar
> (https://github.com/lcp/mokutil/commit/7b49e834284659527c9f7cf554f223748c00564b)
> should work properly.
> 
> fwupdate works properly in most instances except for an install time
> cleanup script that removes stale variables.  This is fixed with a
> trivial change:
> https://github.com/rhinstaller/fwupdate/pull/50/commits/535d3a0f9c096d452cc7e2b5be79cf964e2d6d5b

Indeed. Given that the kernel patch works around such a serious
problem, I'm inclined to encourage distributions to upgrade mokutil
and fwupdate.