1 |
On Thu, 13 Jul 2017 10:29:06 -0400 Mike Gilbert wrote: |
2 |
> On Thu, Jul 13, 2017 at 7:35 AM, M. J. Everitt <m.j.everitt@×××.org> wrote: |
3 |
> > On 13/07/17 12:09, Rich Freeman wrote: |
4 |
> >> Presumably you'd only want to remount it if it was mounted ro to |
5 |
> >> start, since it sounds like openrc will be diverging from systemd |
6 |
> >> behavior here. |
7 |
> >> |
8 |
> >> While it seems like a good idea I'm not sure how big an improvement it |
9 |
> >> is in the larger scheme. We're worried about root accidentially |
10 |
> >> modifying efivars, but we have no safeguards against root writing to |
11 |
> >> /dev/sda, and the latter seems much more likely to cause harm, and is |
12 |
> >> harder to fix. |
13 |
> >> |
14 |
> > In case you weren't aware, Rich, rewriting the efivars actually writes |
15 |
> > to the system BIOS, which renders the computer completely unbootable .. |
16 |
> > not quite the same as erasing the boot sector of your hard disk, where |
17 |
> > you simply plug in another device, and Off you go ... |
18 |
> > |
19 |
> |
20 |
> We are actually talking about protecting people who run something like |
21 |
> rm -rf /sys/firmware/efi/efivars/ as root. |
22 |
> |
23 |
> If you are dumb enough to do something like that, you almost deserve |
24 |
> to spend a couple hundred on a new motherboard. |
25 |
|
26 |
Or just rm -rf / |
27 |
[pedantic] |
28 |
of course with newer rm versions one needs to run: |
29 |
rm -rf --no-preserve-root / |
30 |
or |
31 |
rm -rf /* /.* |
32 |
[/pedantic] |
33 |
|
34 |
But in some scenarios this command is normal. E.g. user installs |
35 |
Gentoo from some live dvd/flash, makes some mistakes, understands |
36 |
that system is broken beyond repair and decides to start over again. |
37 |
If there is no need to recreate filesystem itself or partition |
38 |
layout, running rm -rf / as above is quite reasonable. |
39 |
|
40 |
When running this command user expects to kill the data, but not |
41 |
the hardware. That is my point. I can't call such action dumb. |
42 |
|
43 |
Best regards, |
44 |
Andrew Savchenko |