On Fri, Feb 16, 2018 at 9:09 PM, Luck, Tony <tony.luck@xxxxxxxxx> wrote: >> That said, I'm not sure how many non-root users run the toolkit to >> extract their EFI certificates or check on the secure boot status of >> the system, but I suspect it might be non-zero: I can see the tinfoil >> hat people wanting at least to check the secure boot status when they >> log in. > > Another fix option might be to rate limit EFI calls for non-root users (on X86 > since only we have the SMI problem). That would: > > 1) Avoid using memory to cache all the variables > 2) Catch any other places where non-root users can call EFI I'm going to go out on a limb and suggest that the fact that unprivileged users can read efi variables at all is a mistake regardless of SMI issues. Also, chmod() just shouldn't work on efi variables, and the mode passed to creat() should be ignored. After all, there's no backing store for the mode. -- To unsubscribe from this list: send the line "unsubscribe linux-efi" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
