Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

iot2050-efivarfs-helper: handle efivarfs dynamically during runtime #578

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

iot2050-efivarfs-helper: handle efivarfs dynamically during runtime #578

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
33 changes: 32 additions & 1 deletion recipes-app/iot2050-efivarfs-helper/files/iot2050-efivarfs-helper.tmpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,9 +79,40 @@ def check_mount_efivarfs() -> bool:
if 'rw' in mount_options and 'ro' not in mount_options:
mount_err_msg = ''
else:
mount_err_msg = 'not mounted as read & write.'
# efivarfs is mounted as read-only
mount_err_msg = 'mounted as read-only.'
# Try to remount as read-write
print("efivarfs mounted as read-only. Attempting to remount efivarfs as read-write...", end='')
try:
subprocess.run(['mount', '-o', 'remount,rw', '/sys/firmware/efi/efivars'], check=True)
print("Remount successful.")
mount_err_msg = '' # No error, remount was successful
except subprocess.CalledProcessError:
mount_err_msg = 'failed to remount as read-write.'
break

if mount_err_msg == 'not mounted.':
'''
By default, the kernel or systemd mounts efivarfs as read-only (ro) to prevent
accidental modifications to UEFI variables, which are critical for system operation.
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I doubt that. Also efibootmgr needs this as r/w, and I don't think it remounts it on demand.

Furthermore, your patch leaves efivarfs r/w mounted behind - where is the improvement then?

Copy link
Collaborator

@BaochengSu BaochengSu Feb 6, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I guess most of the related tools/applications expect this efivarfs mounted as R/W for a normal operation.

Additionally, there is already an immutable flag on the efivarfs, which need to be toggled before/after the manipulating of the security database. And the current script has been handling this flag - remove this immutable flag before any efivarfs update, then added it back after the operation, under the root permission. I think this is the mechanism part, and the policy part is left to the tools/application or even level 8.

BTW, the latest head has an issue on the r/w efivarfs: even declared as r/w in the /etc/fstab, the filesystem is still mounted as ro. A bisection told me it was due to the latest kernel update, however, hadn't got the enough time to dive deeper. Workaround is to remount the efivarfs.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @BaochengSu and @jan-kiszka for you inputs,

Yes, In the older kernel version (6.1.54-cip6), remounting efivarfs as read-write was working fine. However, in the newer kernel version (6.1.102-cip26), which we are currently using, efivarfs is not being mounted as read-write at any stage of the boot process.

We have attempted to mount efivarfs as read-write both in the initramfs and using a systemd service running at the multi-user.target phase, but in all cases, the system does not allow it.
However, once the system has fully booted, we are able to successfully remount efivarfs as read-write using the following command:

mount -o remount,rw /sys/firmware/efi/efivars

Copy link
Collaborator

@BaochengSu BaochengSu Feb 6, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@rakeshk7097 , I think the real issue here is that the efivarfs is mounted as read-only. (Maybe our backporting of the efi_stmm has some flow?) The current postinit of adding the r/w into fstab is already a workaround...

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think eventually we will fix the readonly issue, before then, I think downstream can hold their own whatever workaround, just make it easier to be 'uninstalled'.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sure @BaochengSu , thanks for your input on this.

However, the kernel permits remounting efivarfs as read-write (rw) since it is already
mounted, making this a controlled and intentional change when necessary.
'''
print("Not mounted. Mounting efivarfs ...", end='')
try:
subprocess.run(['mount', '-t', 'efivarfs', 'efivarfs', '/sys/firmware/efi/efivars'], check=True)
print("Mount successful.")
print("Attempting to remount as read-write...", end='')
# Remount as read-write
try:
subprocess.run(['mount', '-o', 'remount,rw', '/sys/firmware/efi/efivars'], check=True)
print("Remount as read-write successful.")
mount_err_msg = '' # No error
except subprocess.CalledProcessError:
mount_err_msg = 'failed to remount as read-write.'
except subprocess.CalledProcessError:
mount_err_msg = 'failed to mount efivarfs.'

if mount_err_msg == '':
print("Done.")
return True
Expand Down
12 changes: 0 additions & 12 deletions recipes-app/iot2050-efivarfs-helper/files/postinst
View file
Open in desktop

This file was deleted.

3 changes: 1 addition & 2 deletions recipes-app/iot2050-efivarfs-helper/iot2050-efivarfs-helper_0.1.bb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,8 +12,7 @@ inherit dpkg-raw
DESCRIPTION = "Efivarfs Helper"
MAINTAINER = "baocheng.su@siemens.com"

SRC_URI = "file://iot2050-efivarfs-helper.tmpl \
file://postinst"
SRC_URI = "file://iot2050-efivarfs-helper.tmpl"

TEMPLATE_FILES = "iot2050-efivarfs-helper.tmpl"

Expand Down