Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
MIME-Version: 1.0
References: <20230512194302.1662230-1-nicholasbishop@google.com> <CAMj1kXERDgT1cM-2P4M=DBGU0Wzbc-zewGsJjLQoQHpC3ds-4g@mail.gmail.com>
In-Reply-To: <CAMj1kXERDgT1cM-2P4M=DBGU0Wzbc-zewGsJjLQoQHpC3ds-4g@mail.gmail.com>
From:   Peter Jones <pjones@redhat.com>
Date:   Tue, 6 Jun 2023 13:45:00 -0400
Message-ID: <CA+g+hrjBhOeAHiLU9i=hpfp-0S2wCr9VyNQRKSxMGrv+9GR=oQ@mail.gmail.com>
Subject: Re: [PATCH] efi/esrt: Allow ESRT access without CAP_SYS_ADMIN
To:     Ard Biesheuvel <ardb@kernel.org>
Cc:     Nicholas Bishop <nicholasbishop@google.com>,
        linux-efi@vger.kernel.org, linux-kernel@vger.kernel.org
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Precedence: bulk

On Mon, May 22, 2023 at 4:11=E2=80=AFAM Ard Biesheuvel <ardb@kernel.org> wr=
ote:
>
> On Fri, 12 May 2023 at 21:43, Nicholas Bishop <nicholasbishop@google.com>=
 wrote:
> >
> > Access to the files in /sys/firmware/efi/esrt has been restricted to
> > CAP_SYS_ADMIN since support for ESRT was added, but this seems overly
> > restrictive given that the files are read-only and just provide
> > information about UEFI firmware updates.
> >
> > Remove the CAP_SYS_ADMIN restriction so that a non-root process can rea=
d
> > the files, provided a suitably-privileged process changes the file
> > ownership first. The files are still read-only and still owned by root =
by
> > default.
> >
> > Signed-off-by: Nicholas Bishop <nicholasbishop@google.com>
>
> Seems reasonable to me. Peter?

Yeah, I don't think we had any specific reason to limit it.

-- Peter