On Thu, Jul 13, 2017 at 12:45 PM, Mike Gilbert <flop...@gentoo.org> wrote: > On Thu, Jul 13, 2017 at 10:58 AM, Andrew Savchenko <birc...@gentoo.org> wrote: >> On Thu, 13 Jul 2017 10:29:06 -0400 Mike Gilbert wrote: >>> On Thu, Jul 13, 2017 at 7:35 AM, M. J. Everitt <m.j.ever...@iee.org> wrote: >>> > On 13/07/17 12:09, Rich Freeman wrote: >>> >> Presumably you'd only want to remount it if it was mounted ro to >>> >> start, since it sounds like openrc will be diverging from systemd >>> >> behavior here. >>> >> >>> >> While it seems like a good idea I'm not sure how big an improvement it >>> >> is in the larger scheme. We're worried about root accidentially >>> >> modifying efivars, but we have no safeguards against root writing to >>> >> /dev/sda, and the latter seems much more likely to cause harm, and is >>> >> harder to fix. >>> >> >>> > In case you weren't aware, Rich, rewriting the efivars actually writes >>> > to the system BIOS, which renders the computer completely unbootable .. >>> > not quite the same as erasing the boot sector of your hard disk, where >>> > you simply plug in another device, and Off you go ... >>> > >>> >>> We are actually talking about protecting people who run something like >>> rm -rf /sys/firmware/efi/efivars/ as root. >>> >>> If you are dumb enough to do something like that, you almost deserve >>> to spend a couple hundred on a new motherboard. >> >> Or just rm -rf / >> [pedantic] >> of course with newer rm versions one needs to run: >> rm -rf --no-preserve-root / >> or >> rm -rf /* /.* >> [/pedantic] >> >> But in some scenarios this command is normal. E.g. user installs >> Gentoo from some live dvd/flash, makes some mistakes, understands >> that system is broken beyond repair and decides to start over again. >> If there is no need to recreate filesystem itself or partition >> layout, running rm -rf / as above is quite reasonable. >> >> When running this command user expects to kill the data, but not >> the hardware. That is my point. I can't call such action dumb. >> >> Best regards, >> Andrew Savchenko > > Point taken. > > Although, if the user is in the process of installing Gentoo, efivarfs > is likely to be mounted rw anyway so that the user can install a boot > loader. Having grub-install perform the remount would minimize this > small risk I suppose.
s/grub-install/efibootmgr/; grub-install does not update efivarfs directly, but rather calls efibootmgr to do it.
