Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1363178

Re: [PATCH] Add fwupdate and Mok GUID's to the EFI variable immutable whitelist

Show all headers | View raw

On 03/22/2016 04:37 PM, Limonciello, Mario wrote:
> ed8b0de5a33d2a2557dce7f9429dca8cb5bc5879 caused all variables to be
> immutable by default.  This causes problems with userspace applications
> mokutil and fwupdate.
> ---
>  drivers/firmware/efi/vars.c | 2 ++
>  include/linux/efi.h         | 8 ++++++++
>  2 files changed, 10 insertions(+)
>
> diff --git a/drivers/firmware/efi/vars.c b/drivers/firmware/efi/vars.c
> index 0ac594c..16bd2a9 100644
> --- a/drivers/firmware/efi/vars.c
> +++ b/drivers/firmware/efi/vars.c
> @@ -199,6 +199,8 @@ static const struct variable_validate variable_validate[] = {
>  	{ EFI_GLOBAL_VARIABLE_GUID, "PlatformLang", validate_ascii_string },
>  	{ EFI_GLOBAL_VARIABLE_GUID, "Timeout", validate_uint16 },
>  	{ LINUX_EFI_CRASH_GUID, "*", NULL },
> +	{ FWUPDATE_GUID, "fwupdate*", NULL },
> +	{ MOK_GUID, "Mok*", NULL },
>  	{ NULL_GUID, "", NULL },
>  };
>  
> diff --git a/include/linux/efi.h b/include/linux/efi.h
> index 1626474..c882cb0 100644
> --- a/include/linux/efi.h
> +++ b/include/linux/efi.h
> @@ -575,6 +575,14 @@ void efi_native_runtime_setup(void);
>  	EFI_GUID(0x8be4df61, 0x93ca, 0x11d2, \
>  		 0xaa, 0x0d, 0x00, 0xe0, 0x98, 0x03, 0x2b, 0x8c)
>  
> +#define FWUPDATE_GUID \
> +	EFI_GUID(0x0abba7dc, 0xe516, 0x4167, \
> +		 0xbb, 0xf5, 0x4d, 0x9d, 0x1c, 0x73, 0x94, 0x16)
> +
> +#define MOK_GUID \
> +	EFI_GUID(0x605dab50, 0xe046, 0x4300, \
> +		 0xab, 0xb6, 0x3d, 0xd8, 0x10, 0xdd, 0x8b, 0x23)
> +
>  #define UV_SYSTEM_TABLE_GUID \
>  	EFI_GUID(0x3b13a7d4, 0x633e, 0x11dd, \
>  		 0x93, 0xec, 0xda, 0x25, 0x56, 0xd8, 0x95, 0x93)
Actually, I think this patch should be discarded unless there is a
desire to make the kernel work with older userspace tools. 

I later realized that efivar 0.22 will actually handle working with
immutable variables properly.  This means that mokutil 0.2 won't work
with this kernel commit, but mokutil 0.3 which uses efivar
(https://github.com/lcp/mokutil/commit/7b49e834284659527c9f7cf554f223748c00564b)
should work properly.

fwupdate works properly in most instances except for an install time
cleanup script that removes stale variables.  This is fixed with a
trivial change:
https://github.com/rhinstaller/fwupdate/pull/50/commits/535d3a0f9c096d452cc7e2b5be79cf964e2d6d5b

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH] Add fwupdate and Mok GUID's to the EFI variable immutable whitelist Mario Limonciello <mario_limonciello@dell.com> - 2016-03-22 22:50 +0100
  Re: [PATCH] Add fwupdate and Mok GUID's to the EFI variable immutable  whitelist Mario Limonciello <mario_limonciello@dell.com> - 2016-03-23 03:40 +0100
    Re: [PATCH] Add fwupdate and Mok GUID's to the EFI variable  immutable whitelist Matt Fleming <matt@codeblueprint.co.uk> - 2016-03-23 22:10 +0100

csiph-web