Slashdot Mirror
Running "rm -rf /" Is Now Bricking Linux Systems (phoronix.com)
An anonymous reader writes: For newer systems utilizing UEFI, running rm -rf / is enough to permanently brick your system. While it's a trivial command to run on Linux systems, Windows and other operating systems are also prone to this issue when using UEFI. The problem comes down to UEFI variables being mounted with read/write permissions and when recursively deleting everything, the UEFI variables get wiped too. Systemd developers have rejected mounting the EFI variables as read-only, since there are valid use-cases for writing to them. Mounting them read-only can also break other applications, so for now there is no good solution to avoid potentially bricking your system, but kernel developers are investigating the issue.
I read up on this - it's bricking the system as in "wiping EFI data in ROM", meanin the motherboard is now a brick. Prior to UEFI and systemd, 'rm -rf /' would only wipe the disk, and you could rebuild from backups if you had them
While not running systemd is always a good idea, it wouldn't change anything with regards to this, as the EFI variables are in /sys/firmware/efi/vars regardless of what init system you use.
You wanted the "everything is a file" UNIX approach*.. well, you got it, including the ability to delete *every* file.
Incidentally, while systemd was being blamed for this, the underlying /sysfs structures have zippo to do with systemd, so put down the pitchforks.
* Which has never actually been completely true but is a popular catch phrase.
AntiFA: An abbreviation for Anti First Amendment.
The kernel dev who wrote the efi code says it's not a systemd problem and following the bug report's suggestion would be the wrong way to solve the problem.
But don't let that stop you from jumping on your favorite whipping boys.
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
No, UEFI doesn't read variables off the disk, there's a kernel module that understands EFI confiig flash space, and exposes the data. Removing files from that pseudo-filesystem is like nuking the config flash area. Note firmware should still be able to tolerate this in theory, but it's not just 'some files got removed'.
The most robust answer is that efivars should not interpret unlink() to erase from flash, instead offering some special ioctl() so a calling program can say they *really* mean it.
XML is like violence. If it doesn't solve the problem, use more.
Linux is anything but fragile. Stop blaming the OS for a shitty design in UEFI! Linux is so stable and solid that it lets you run "rm -rf /" and it will actually do what you asked it to until it can no longer figure out the machine it's on and commands needed to talk to a disk. This is a more than 45 year old design. Yes, that's right. In AT&T's original Unix you could also kill a system with "rm -rf /".
'but', 'but', 'but', oh shut up and stop spreading FUD! "rm" is the remove command, "-r" is recursive, and "-f" is force. You need to be root to run this with any success, so it's not like any old user can remove everything.
The problem is that UEFI allows an OS to write to areas which it should not be able to write to. If you open all the PROM in a system it's not just the OS that can brick a system. A malicious person can do so just as easy, and without being so obvious as running "rm -rf /"
-The wise argue that there are few absolutes, the fool argues that there are no probabilities.
Exactly. The real problem here isn't that root can do stuff. The real problem is that root can do stuff accidentally by sneezing five metres away from the system at lunchtime.
Of course, the other real problem is that anyone is crazy enough to make hardware/firmware where you can delete essential data like this and have no recovery or at least factory reset mechanism, regardless of anything the OS might be doing. People making hardware vulnerable to this should be getting named and shamed as well.
If you disagree, post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like.
Note this isn't so much a UEFI v. BIOS thing, it's the fact that UEFI standardized an interface for the configuration information, and Linux implemented an interface that modeled it as a normal-as-possible filesystem. UEFI itself doesn't prescribe at all how to model the variables, just defines the interface to allow the kernel to do so.
XML is like violence. If it doesn't solve the problem, use more.
To my understanding, you can't boot anymore, at all. If we could simply boot to BIOS and reflash the firmware this wouldn't be such a big issue.
To be fair, reading TFA it doesn't seem to be a general EFI bug at all, but merely a bug with some implementations of it. TFA mentions "some MSI notebooks", but isn't more specific than that. So yes, this seems like a particular hardware bug, rather than a bug with either UEFI, the Linux kernel, systemd, or any other software bug in general.
It says in TFA that firmware is overwritten (and on a UEFI system, effectively the BIOS). So, simply reinstalling the f Operating system would not work in this case. Whether or not it's truly bricked, would depend on whether it's possible to re-flash that firmware. I'm sure that it IS possible, but how to do so would depend on how the machine is physically configured. Perhaps by putting some utility on a flash card? Perhaps by opening the computer case and doing something more pyhsical. So, no. Probably not bricked in the purest sense, but certainly more so in a practical sense than simply removing the OS.
BIOS no longer exists at all in modern systems. If you look at its limitations, (which modern OSes had to work around) it's kind of ridiculous that it lasted as long as it did. You have UEFI which is modular (and contrary to popular belief, UEFI has nothing to do with a graphical shell or boot code signing, rather those are optional modules that most motherboard manufacturers include, the first to make their product shiny, and the later because IT Security professionals have been wanting it as a means of eliminating boot code malware; you can load your own keys if you want, and because MS signing keys are so common they're often included by default.)
UEFI remains compatible with things that need BIOS by including a module (often called Compatibility Support Module) that adds archaic crap like certain interrupts if the OS needs them and POST if any hardware you have needs that. Protip: If your setup doesn't need any of that crap, turn off the BIOS compatibility module and you get a faster boot speed.
Perhaps you try reading the summary.
"Bricked" indicates that the firmware is bad.
Yes, yes it does. And that's exactly what's being described.
systemd is Roko's Basilisk.
That's what this is. Some really crappy UEFI firmware from MSI can be bricked by deleting some of the EFI variables. The only way to recover is to reflash the BIOS memory chip with an external programmer. On laptops the chip is often surface mount with no pins, so you have to desolder it with hot air, flash it and replace it.
Okay, technically it is recoverable, but in reality its well beyond the ability of most computer repair shops, if they can even figure out what the problem is.
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
This looks like an EFI design bug. Why should EFI allow the OS or any other software brick the system by deleting its variables? Like OO, EFI should allow access to these variables through methods and not directly.
That you reached +5 makes me weep for Slashdot.
It's completely normal for a *nix based system to expose something like UEFI variables through the filesystem. It's a concept called Everything is a File and is the same reason why root can read and poke places in /proc and /dev to get information about the system or make changes to it. I can sympathize with the systemd developers on this one (I know, get a rope) because making a unilateral decision to force UEFI read-only over this one issue will have a long-standing and huge impact of system administration (and this goes double controlling large networks of systems).
The fact that root running rm -rf / causes problems shouldn't surprise anyone. Even with newer flags like --no-preserve-root, running as root means exerting ultimate control. Some care is expected or eventually you'll get burned.
Besides, the real question here I think is: Why don't these motherboards have a ROM backup that can be used to restore and boot the boards after catastrophic failure of their saved state? Even without the rm -rf / red herring, that seems like a brain-dead requirement, and one that legacy boards have supported for decades.
"What do you despise? By this are you truly known." --Princess Irulan, Manual of Muad'Dib
/)
I wished all the config files were located in a single root-level directory (like "home"), perhaps named "cfg".
You've just invented /etc...
There should ALWAYS be a way to reset a boot loader to a default usable state, whether it's by holding down the power button for 10 seconds or some other hardware based override, or having the bootloader on a microSD card that you can take out and fix on any other computer, or a pre-boot-loader phase where a keyboard override routes to a low level interface where you can fix things, or a jumper or switch inside the case that does the same thing. There should also always be a backup firmware image that can be used.
I'd also think that having the efivar interface expose each variable as a separate file isn't a particularly good idea. Having a simple program to modify variables using another mechanism isn't all that terrible, the convenience of being able to use echo to change a variable isn't worth the risk.
An ARM system I use has u-boot variables at a fixed location on the SD slot boot device, which is hardwired (on the SoC with fuses) to be the only boot source (which can then boot something else either from the SD card or some other device, u-boot itself starts up in well under a second). You can take the microSD card out and put whatever bootloader you want on it, or modify the variable block from the OS by direct writes to a partition (or to a known location on the raw device). The block is checksummed, and u-boot falls back to a default configuration if it's trashed.
The program to read or write variables is quite simple and easy to use in a script.
There's no reason UEFI couldn't do something similar. Last I looked I didn't see an open UEFI implementation on ARM, it might be fun to try replacing u-boot with UEFI and see what it takes to get Linux to boot with it.
Mounting UEFI variables as read only breaks things too. How will you get rid of that problem once you get rid of systemd? Or is everything systemd's fault by default now?
It's not systemd's fault that the kernel allows access to UEFI variables; it's systemd's fault for mounting those variables in a read/write mode by default and closing the bug WONTFIX because LP didn't think it was a problem. systemd now controls that default, not the distributions, not the writer of the `mount` program, not the initscripts package (on RedHat)... and even /etc/fstab is considered more like a guideline than a rule for systemd to interpret.
As I wrote in a post on that Github bug report that the Great And Powerful Lennart saw fit to remove:
And furthermore, systemd is keeping it R/W because it's a apparently feature not a bug:
Thanks, systemd. This is now the time to point out that /sbin/init didn't need to do sh*t like "boot into the EFI firmware setup" and this is exactly why people with concerns about systemd say that it's doing too much. Putting systemd (either pid1 and/or the package into the whole) in the loop is not necessary and is not a paradigm anyone ever asked for... except the freedesktop.org crowd, and Lennart himself.
Hire a Linux system administrator, systems engineer,