Re: [PATCH] Add fwupdate and Mok GUID's to the EFI variable immutable whitelist

[Matt Fleming]

On Tue, 22 Mar, at 09:36:25PM, Mario Limonciello wrote:
>
> Actually, I think this patch should be discarded unless there is a
> desire to make the kernel work with older userspace tools. 
> 
> I later realized that efivar 0.22 will actually handle working with
> immutable variables properly.  This means that mokutil 0.2 won't work
> with this kernel commit, but mokutil 0.3 which uses efivar
> (https://github.com/lcp/mokutil/commit/7b49e834284659527c9f7cf554f223748c00564b)
> should work properly.
> 
> fwupdate works properly in most instances except for an install time
> cleanup script that removes stale variables.  This is fixed with a
> trivial change:
> https://github.com/rhinstaller/fwupdate/pull/50/commits/535d3a0f9c096d452cc7e2b5be79cf964e2d6d5b

Indeed. Given that the kernel patch works around such a serious
problem, I'm inclined to encourage distributions to upgrade mokutil
and fwupdate.