linux-kernel - RE: Re: [PATCH v2 3/3] efi: Capsule update with user helper interface

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <F54AEECA5E2B9541821D670476DAE19C2B8AF844@PGSMSX102.gar.corp.intel.com>
Date:	Fri, 6 Mar 2015 11:41:57 +0000
From:	"Kweh, Hock Leong" <hock.leong.kweh@...el.com>
To:	Borislav Petkov <bp@...en8.de>,
	Andy Lutomirski <luto@...capital.net>
CC:	Matt Fleming <matt@...sole-pimps.org>,
	"Ong, Boon Leong" <boon.leong.ong@...el.com>,
	"linux-efi@...r.kernel.org" <linux-efi@...r.kernel.org>,
	Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
	Sam Protsenko <semen.protsenko@...aro.org>,
	LKML <linux-kernel@...r.kernel.org>,
	Ming Lei <ming.lei@...onical.com>
Subject: RE: Re: [PATCH v2 3/3] efi: Capsule update with user helper
 interface

> -----Original Message-----
> From: Borislav Petkov [mailto:bp@...en8.de]
> Sent: Friday, March 06, 2015 4:14 PM
> 
> On Thu, Mar 05, 2015 at 03:08:42PM -0800, Andy Lutomirski wrote:
> > No.  Only root should be able to load capsules, but even root may not
> > be able to write to /lib.
> 
> So basically what we want to do is:
> 
> # cat /any/path/to/efi/capsule/accessible/to/root/efi_capsule.img >
> /sys/firmware/efi/update
> 
> Now it can't get any simpler than that and you get error codes too by
> failing the cat if the update fails.
> 
> Mind you, I'm using '#' and not '$' as a shell prompt :-)
> 
> --
> Regards/Gruss,
>     Boris.
> 
> ECO tip #101: Trim your mails when you reply.
> --

I believe you guys are more paying attention to the PATH and
whether doing:
# cat /any/path/capsule.bin > /sys/devices/platform/efi_capsule/capsule_load

or doing:
# echo "/any/path/capsule.bin" > /sys/devices/platform/efi_capsule/capsule_load

is not a big issue right?


Regards,
Wilson