Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Systemd mounted efivarfs read-write, allowing motherboard bricking via 'rm'

github.com

Post reply on HN
Print view View original

111–120 of 180 posts

Re: Systemd mounted efivarfs read-write, allowing motherboard bricking via 'rm'

#111

Post by CodeWriter23 »

Someone wrote: post #10

The comments by Lennart Poettering, IMO, are a prime example of the schism between what is needed for reaching "the year of Linux on the desktop" and what some hackers think is best. Nobody sells a chainsaw with safeties disabled, remarking "you can always attach the chain catcher" if people report a couple of accidents, but Lennart thinks requiring almost every user to change the default install ( (note that you can…

I was taught "least privilege" was a fundamental principle of computer security. I guess this guy was taught differently.

Actually, it's more like this. I remember when I used to blame my users for what my software could do.

Re: Systemd mounted efivarfs read-write, allowing motherboard bricking via 'rm'

#112

Post by bigbugbag »

kbenson wrote: post #42
Someone wrote: post #10

The comments by Lennart Poettering, IMO, are a prime example of the schism between what is needed for reaching "the year of Linux on the desktop" and what some hackers think is best. Nobody sells a chainsaw with safeties disabled, remarking "you can always attach the chain catcher" if people report a couple of accidents, but Lennart thinks requiring almost every user to change the default install ( (note that you can…

That is an extremely uncharitable reading of what he wrote, and I don't think it captures the essence of his intent at all. He said: > Well, there are tools that actually want to write it. It needs to be accessible in some manner. > The ability to hose a system is certainly reason enought to make sure it's well protected and only writable to root. Agreement it needs to be guarded, because it's a problem if it can hos…

Hosing a system is a way different than bricking a motherboard.

Hosing a system is something that can be fixed by root by reinstalling from scratch or restoring from backup. Bricking hardware is not something a sysadmin can fix by himself.

Poettering attitude refusing to acknowledge his mistakes and fixing them is not something new.

Someone who doesn't get the difference between deleting the content of a drive and rendering hardware inoperable shouldn't be in charge of a critical system component.

Re: Systemd mounted efivarfs read-write, allowing motherboard bricking via 'rm'

#113

Post by pjmlp »

Ao7bei3s wrote: post #110
pjmlp wrote: post #95

Earlier quoted context omitted.

So in a similar vein, why bother with alias rm='rm -i' at all?

But that doesn't actually exist by default, and so it's not a good example. A better example is that `/` is a special case for `rm`. (Besides: I'm not a fan of `rm -i`, precisely because it's non-default. You'll get used to it, and then someday you accidentally some files on a system where you didn't add the alias.)

Lots of GNU/Linux distributions used to it by default, has it changed?

Re: Systemd mounted efivarfs read-write, allowing motherboard bricking via 'rm'

#114

Post by Aloha »

So, the short read here is, one (arguably poorly thought out) complex system interacts with another (again, arguably poorly thought out) complex system in unthought about ways... Why is anyone surprised?

I'm no fan of systemd or Poettering, but this behavior is consistent for unix, root can do anything, including break peripherals or hardware thru poorly advised actions - why is this a big to do?

Re: Systemd mounted efivarfs read-write, allowing motherboard bricking via 'rm'

#115

Post by jhkaghjkga »

pjmlp wrote: post #95
microcolonel wrote: post #91

Earlier quoted context omitted.

The point is that that would offer no benefit. A root user can just mount it rw again in a single call.

So in a similar vein, why bother with alias rm='rm -i' at all?

Sane distributions don't include that alias by default. Because otherwise people will always use `rm -f` and lose the feature that `rm` asks before removing files marked as read-only.

Re: Systemd mounted efivarfs read-write, allowing motherboard bricking via 'rm'

#116

Post by threatofrain »

uxcn wrote: post #86
threatofrain wrote: post #62

Earlier quoted context omitted.

I also think that desktop vs server are two different domains. The desktop / personal user domain is looking like it's in the early stages of transformation, with mass data collection to support voice search and user intent prediction. While there's something to be said for privacy, I don't think consumers will care enough, and I don't think desktop linux systems outside of whatever Google may make is going to be ade…

Linux is just source for a kernel that the userland for the various distributions are built on though. It's already largely on people's phones with Android. In fact, Chrome OS is based on Linux.

That appears to validate my belief that only Google can competitively take the Linux kernel and build atop it a software stack known as a desktop/mobile/user operating system.

And if my assertion that intention prediction and voice search will be competitive features for users, features that rely on mass data collection and expensive top talent, then I think organizations like Canonical or RedHat will fall behind in the desktop/mobile/user os space.

Re: Systemd mounted efivarfs read-write, allowing motherboard bricking via 'rm'

#117

Post by krylon »

magila wrote: post #60
CoconutPilot wrote: post #43

Unix has a long tradition of doing a `rm -rf /` before reinstalling a system. I don't agree with the people saying "don't do that". It worked safely before, it should still be safe to do. (yes I know about --no-preserve-root)

`rm -rf /` was never safe, even if reinstalling the system. If it worked for you then you were just lucky. In the context doing a reinstall you need to specify --one-file-system, but really you should just reformat the partition, it'll likely be much faster anyways.

On one episode of BSD Now[1], Bryan Cantrill tells how they made 'rm -rf /' not work on Solaris. It seems like a good idea in that they managed to stay compliant to POSIX while disarming that particular foot seeking-missile.

Or, in other words: I agree completely, in fifteen years I have never used 'rm -rf /', I always used mkfs to create fresh filesystem.

[1] http://www.bsdnow.tv/episodes/2015_08_19-ubuntu_slaughters_k...

Re: Systemd mounted efivarfs read-write, allowing motherboard bricking via 'rm'

#118

Post by bigbugbag »

krylon wrote: post #109
mmastrac wrote: post #4

These threads are never productive. Running rm -rf / is going to offer multiple interesting ways to make your life miserable, eg: a mounted FUSE filesystem, an NFS folder pointed somewhere important, Samba mounts from your network automatically connected from your desktop, etc. I wouldn't be surprised if you could nuke firmware off a device by deleting the appropriate file in /sys/. Systemd hate is en vogue these day…

> Systemd hate is en vogue these days To be fair, Lennart Poettering could probably end war and famine forever in a single day, and some people would still find something wrong with that. On the other hand a certain amount of skepticism and criticism is very much in order. (I am saddened, though, by the way online discussions so easily deteriorate into name-calling and bitter ranting.) Just to be clear, I was highly…

On the other hand I was happy and welcoming of systemd then I started to experience way too many breakage due to attitude of the devs.

When you have to spend 2 days to get to a remote server room and back because suddenly systemd decided that a device in fstab not present at boot would halt boot with error and at the same time the emergency shell was broken and going into a loop of asking for credentials, on a debian server, in production.

Ok systemd works most of the time but after experiencing a few of these breakages I've become wary of anything systemd. Whatever it brings to the table is not worth the wasted time and headaches it causes.

Re: Systemd mounted efivarfs read-write, allowing motherboard bricking via 'rm'

#119

Post by threatofrain »

enedil wrote: post #28
victorhugo31337 wrote: post #19

Earlier quoted context omitted.

I think the "Year of Linux on the desktop" thing is BS and needs to stop. It's been the year of Linux on the desktop for 15 years now. Can't GNU/Linux just be a solid server platform? Not trying to be a troll, but if someone says "the year of Linux on the desktop" one more time...

Linux is important on dekstops to thrive. I've successfully transitioned my parents to Linux. What I got? Deser maintainance, more reliability, everything just works for them. And of course, sticking to proprietary solutions in a long run would be rather a sick idea.

I think that pretty soon features backed by machine learning and mass data collection, features like intention comprehension and prediction or voice command/search, will be commonplace and hotly desired by users.

When that happens, I don't think the Canonical or Redhat will be able to compete, and only Google will be able to create an OS on top of Linux, and open-sourcing won't do any good because the most important services will be behind Google servers.

Re: Systemd mounted efivarfs read-write, allowing motherboard bricking via 'rm'

#120

Post by [deleted] »

snuxoll wrote: post #104
moonbug wrote: post #38

Earlier quoted context omitted.

Good.

I could do it in an RPM post-install script too if it will get people to stop whining about running arbitrary scripts. All software you install on your system through binaries is potentially suspect to an extend. Sure, I trust the Fedora build system to do the right thing, so I can with some certainty assume anything in the Fedora Collection or EPEL is "safe" - but when I need to install 3rd party software to get my…

[deleted]
Post reply on HN