> By default, any users are able to install firmware to removable hardware. The logic here is that if the hardware can be removed, it can easily be moved to a device that the user already has root access on, and asking for authentication would just be security theatre.
> But it is not given that a user has physical access to the machine, is it?
Yes, I think the logic here is flawed. The only way to know someone can do something in the physical security theatre is by their doing it. Needing to cajole any normal user into running a script is a tad more optimal than convincing them to physically move devices from the server room to the new machine that they won in your raffle.
> The firmware updates themselves are signed and have a checksum, and the metadata describing this checksum is provided by the distribution either as GPG-signed repository metadata, or installed from a package, which is expected to also be signed.
> nearly all thinkpads are undergoing bios updates because of a security issue.. but cannot be done on Linux. I wonder if someone can build a howto for Thinkpads on Linux.
Nonsense. Thinkpads can update the firmware from a bootable CD whose ISO you can download from the Lenovo website.
I did this just last week with my Carbon X1. I can guarantee you that no Windows was ever involved.
BIOS updates for security issues are not new by any means. With the advent of EFI firmwares, we're seeing more security issues than ever.
Here's a revision history[1] for a laptop model I work with. The previous model's history is much the same[2], except the updates stopped after Sept. 2014.
Probably because firmware vendors are not accustomed to working that way. Maybe they are more willing to submit their firmware this way? Time will tell.
Technically, LSB mandates RPM as the standard package format, so deb packages would be non-standard.
For a more serious response, if you look at the architecture diagram, the fwupd daemon is independent of any packaging or download mechanism so there should be nothing preventing you from calling it from dpkg postinstall scripts.
Well gnome-software is obviously restricted to gnome,and it might be the only current gui option but I don't think the system is.
The page states that you can interact using the D-bus api and that's not restricted to gnome: https://en.wikipedia.org/wiki/D-Bus
This is actually pretty sweet. If you are running a non-linux OS you could just reboot into a live disk and pull down all of the updates.
Take it a step further, you could just PXE-boot into a scripted image that loads up and checks for FW updates, then reboots into the default OS when complete.
24 comments
[ 2.7 ms ] story [ 51.1 ms ] thread- http://www.fwupd.org/users.html
But it is not given that a user has physical access to the machine, is it?
Well... I guess that's why it says "By default", and you can configure it? Seems targeted at desktop installations?
Yes, it uses polkit: https://github.com/hughsie/fwupd/tree/master/policy
Yes, I think the logic here is flawed. The only way to know someone can do something in the physical security theatre is by their doing it. Needing to cajole any normal user into running a script is a tad more optimal than convincing them to physically move devices from the server room to the new machine that they won in your raffle.
Maybe if your maid is also a distro developer...
I wonder if someone can build a howto for Thinkpads on Linux.
For a computer outside warranty, that can be pretty expensive.
Nonsense. Thinkpads can update the firmware from a bootable CD whose ISO you can download from the Lenovo website.
I did this just last week with my Carbon X1. I can guarantee you that no Windows was ever involved.
Did I make a mistake ?
Here's a revision history[1] for a laptop model I work with. The previous model's history is much the same[2], except the updates stopped after Sept. 2014.
[1] http://h20565.www2.hp.com/hpsc/swd/public/detail?sp4ts.oid=5...
[2] http://h20564.www2.hp.com/hpsc/swd/public/detail?sp4ts.oid=4...
For a more serious response, if you look at the architecture diagram, the fwupd daemon is independent of any packaging or download mechanism so there should be nothing preventing you from calling it from dpkg postinstall scripts.
Take it a step further, you could just PXE-boot into a scripted image that loads up and checks for FW updates, then reboots into the default OS when complete.