Mount efivars read-only

[dakkar]

Hello!
/etc/init.d/sysfs mounts efivars with the same options as all the other /sys/** filesystems. This will usually result on it being mounted read-write.
But (as discussed in systemd/systemd#2402) this may not be the best choice.
Maybe when mounting efivarsfs we could specify ro.
What do you think?

[cromerc]

I second the change to "ro". I had an issue with systemd mouting efivars as rw while doing an install of Fedora. The fedora installer did something during install(even though I specified that I didn't want to install a bootloader......) that left my entire efi setup was completely erased leaving me with an unbootable system. It erased my arch linux, gentoo, and windows efi files...
Mounting it as rw by default is dangerous. It is better to remount as rw when something needs to be changed, then remount back to ro after the changes are done.

[superm1]

Mounting read only is causing problems with fwupdate and efibootmgr. See
fwupd/fwupd#625

Furthermore it's not necessary since the kernel makes efivarfs immutable.
torvalds/linux@ed8b0de

[cromerc]

@superm1 Considering that many distros are still shipping 3.x kernels still(Cent OS, Debian, Zentyal, RHEL, etc), it is still a necessary precaution in OpenRC to mount them RO by default. Making it an option in OpenRC that can be changed would make more sense.

[joakim-tjernlund]

yes, a config option / USE flag makes most sense.