Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753812AbcCWCgs (ORCPT ); Tue, 22 Mar 2016 22:36:48 -0400 Received: from ausxipps301.us.dell.com ([143.166.148.223]:34272 "EHLO ausxipps301.us.dell.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753519AbcCWCgo (ORCPT ); Tue, 22 Mar 2016 22:36:44 -0400 DomainKey-Signature: s=smtpout; d=dell.com; c=nofws; q=dns; h=X-LoopCount0:X-IronPort-AV:Subject:To:References:Cc:From: Organization:Message-ID:Date:User-Agent:MIME-Version: In-Reply-To:Content-Type:Content-Transfer-Encoding; b=rIJ/L4ezdgruxSZBap/4DikABJCroI4T8mxPV0XBjesjDSi2hNPlltc7 QARE1XvcE3kjt1uBXUl720AxW9ejjq0jYiyr858HNhVFpQGQ4aNpXWbDl 0wiazJ5cjGisJEdZcGL31k/u5cPaGFoy5D+9YH4DyDfnUzQMMFGtAa014 k=; X-LoopCount0: from 10.209.151.17 X-IronPort-AV: E=Sophos;i="5.24,380,1454997600"; d="scan'208";a="774061986" Subject: Re: [PATCH] Add fwupdate and Mok GUID's to the EFI variable immutable whitelist To: LKML References: <1458682653-25831-1-git-send-email-mario_limonciello@dell.com> Cc: "matt@codeblueprint.co.uk" , "mjg59@coreos.com" , "pjones@redhat.com" From: Mario Limonciello Organization: Dell Inc. Message-ID: <56F20129.9020202@dell.com> Date: Tue, 22 Mar 2016 21:36:25 -0500 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.5.1 MIME-Version: 1.0 In-Reply-To: <1458682653-25831-1-git-send-email-mario_limonciello@dell.com> Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 2263 Lines: 56 On 03/22/2016 04:37 PM, Limonciello, Mario wrote: > ed8b0de5a33d2a2557dce7f9429dca8cb5bc5879 caused all variables to be > immutable by default. This causes problems with userspace applications > mokutil and fwupdate. > --- > drivers/firmware/efi/vars.c | 2 ++ > include/linux/efi.h | 8 ++++++++ > 2 files changed, 10 insertions(+) > > diff --git a/drivers/firmware/efi/vars.c b/drivers/firmware/efi/vars.c > index 0ac594c..16bd2a9 100644 > --- a/drivers/firmware/efi/vars.c > +++ b/drivers/firmware/efi/vars.c > @@ -199,6 +199,8 @@ static const struct variable_validate variable_validate[] = { > { EFI_GLOBAL_VARIABLE_GUID, "PlatformLang", validate_ascii_string }, > { EFI_GLOBAL_VARIABLE_GUID, "Timeout", validate_uint16 }, > { LINUX_EFI_CRASH_GUID, "*", NULL }, > + { FWUPDATE_GUID, "fwupdate*", NULL }, > + { MOK_GUID, "Mok*", NULL }, > { NULL_GUID, "", NULL }, > }; > > diff --git a/include/linux/efi.h b/include/linux/efi.h > index 1626474..c882cb0 100644 > --- a/include/linux/efi.h > +++ b/include/linux/efi.h > @@ -575,6 +575,14 @@ void efi_native_runtime_setup(void); > EFI_GUID(0x8be4df61, 0x93ca, 0x11d2, \ > 0xaa, 0x0d, 0x00, 0xe0, 0x98, 0x03, 0x2b, 0x8c) > > +#define FWUPDATE_GUID \ > + EFI_GUID(0x0abba7dc, 0xe516, 0x4167, \ > + 0xbb, 0xf5, 0x4d, 0x9d, 0x1c, 0x73, 0x94, 0x16) > + > +#define MOK_GUID \ > + EFI_GUID(0x605dab50, 0xe046, 0x4300, \ > + 0xab, 0xb6, 0x3d, 0xd8, 0x10, 0xdd, 0x8b, 0x23) > + > #define UV_SYSTEM_TABLE_GUID \ > EFI_GUID(0x3b13a7d4, 0x633e, 0x11dd, \ > 0x93, 0xec, 0xda, 0x25, 0x56, 0xd8, 0x95, 0x93) Actually, I think this patch should be discarded unless there is a desire to make the kernel work with older userspace tools. I later realized that efivar 0.22 will actually handle working with immutable variables properly. This means that mokutil 0.2 won't work with this kernel commit, but mokutil 0.3 which uses efivar (https://github.com/lcp/mokutil/commit/7b49e834284659527c9f7cf554f223748c00564b) should work properly. fwupdate works properly in most instances except for an install time cleanup script that removes stale variables. This is fixed with a trivial change: https://github.com/rhinstaller/fwupdate/pull/50/commits/535d3a0f9c096d452cc7e2b5be79cf964e2d6d5b