linux-kernel - Re: [PATCH] Add fwupdate and Mok GUID's to the EFI variable immutable whitelist

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20160323210745.GJ11676@codeblueprint.co.uk>
Date:	Wed, 23 Mar 2016 21:07:45 +0000
From:	Matt Fleming <matt@...eblueprint.co.uk>
To:	Mario Limonciello <mario_limonciello@...l.com>
Cc:	LKML <linux-kernel@...r.kernel.org>,
	Matthew Garrett <mjg59@...eos.com>,
	Peter Jones <pjones@...hat.com>
Subject: Re: [PATCH] Add fwupdate and Mok GUID's to the EFI variable
 immutable whitelist

On Tue, 22 Mar, at 09:36:25PM, Mario Limonciello wrote:
>
> Actually, I think this patch should be discarded unless there is a
> desire to make the kernel work with older userspace tools. 
> 
> I later realized that efivar 0.22 will actually handle working with
> immutable variables properly.  This means that mokutil 0.2 won't work
> with this kernel commit, but mokutil 0.3 which uses efivar
> (https://github.com/lcp/mokutil/commit/7b49e834284659527c9f7cf554f223748c00564b)
> should work properly.
> 
> fwupdate works properly in most instances except for an install time
> cleanup script that removes stale variables.  This is fixed with a
> trivial change:
> https://github.com/rhinstaller/fwupdate/pull/50/commits/535d3a0f9c096d452cc7e2b5be79cf964e2d6d5b

Indeed. Given that the kernel patch works around such a serious
problem, I'm inclined to encourage distributions to upgrade mokutil
and fwupdate.