24 comments

[ 2.7 ms ] story [ 51.1 ms ] thread
> By default, any users are able to install firmware to removable hardware. The logic here is that if the hardware can be removed, it can easily be moved to a device that the user already has root access on, and asking for authentication would just be security theatre.

- http://www.fwupd.org/users.html

But it is not given that a user has physical access to the machine, is it?

Well... I guess that's why it says "By default", and you can configure it? Seems targeted at desktop installations?

> But it is not given that a user has physical access to the machine, is it?

Yes, I think the logic here is flawed. The only way to know someone can do something in the physical security theatre is by their doing it. Needing to cajole any normal user into running a script is a tad more optimal than convincing them to physically move devices from the server room to the new machine that they won in your raffle.

This completely ignores the "evil maid" scenario.
Not if the firmware updater enforces digital signatures like the ucode update does on CPUs.
(comment deleted)
(comment deleted)
> The firmware updates themselves are signed and have a checksum, and the metadata describing this checksum is provided by the distribution either as GPG-signed repository metadata, or installed from a package, which is expected to also be signed.

Maybe if your maid is also a distro developer...

this has come at a good time. nearly all thinkpads are undergoing bios updates because of a security issue.. but cannot be done on Linux.

I wonder if someone can build a howto for Thinkpads on Linux.

I'm very wary of updating Thinkpad BIOS, since one such update bricked a X230. It ended up by having to get a new mainboard.

For a computer outside warranty, that can be pretty expensive.

> nearly all thinkpads are undergoing bios updates because of a security issue.. but cannot be done on Linux. I wonder if someone can build a howto for Thinkpads on Linux.

Nonsense. Thinkpads can update the firmware from a bootable CD whose ISO you can download from the Lenovo website.

I did this just last week with my Carbon X1. I can guarantee you that no Windows was ever involved.

(comment deleted)
Why can't this be done using standard ways, like deb packages?
Probably because firmware vendors are not accustomed to working that way. Maybe they are more willing to submit their firmware this way? Time will tell.
Technically, LSB mandates RPM as the standard package format, so deb packages would be non-standard.

For a more serious response, if you look at the architecture diagram, the fwupd daemon is independent of any packaging or download mechanism so there should be nothing preventing you from calling it from dpkg postinstall scripts.

The big question is, what vendors will use this system instead of their own horrible systems?
Is it restricted to gnome?
Well gnome-software is obviously restricted to gnome,and it might be the only current gui option but I don't think the system is. The page states that you can interact using the D-bus api and that's not restricted to gnome: https://en.wikipedia.org/wiki/D-Bus
Interesting development. Is there info anywhere of manufacturers who have undertaken to provide updates through this system?
This is actually pretty sweet. If you are running a non-linux OS you could just reboot into a live disk and pull down all of the updates.

Take it a step further, you could just PXE-boot into a scripted image that loads up and checks for FW updates, then reboots into the default OS when complete.