3 ms·
It doesn't just "boot the system". The full EFI specification includes support for runtime services, i.e. proprietary code that keeps running even after your FL
by tremon 5y ago
It doesn't just "boot the system". The full EFI specification includes support for runtime services, i.e. proprietary code that keeps running even after your FLOSS operating system has booted. That's something Linux users should care about: it provides a backdoor for clinging to closed-source drivers on a pretend-open platform. There's already been proof-of-concept EFI viruses, it's only a matter of time until the first antivirus EFI service appears.
- mjg59 5y agoThe UEFI runtime services provide functionality that is not generically exposed through any other OS environment. Linux could just refuse to provide those runtime features, and things would roughly work[1] - we'd still need to call some UEFI features in the boot stub, but the same is true of BIOS (look at what the 16-bit code does in terms of obtaining information that the kernel uses after init). If you want to drop all access to runtime services after kernel boot, you can by simply passing efi=noruntime to the kernel arguments. [1] Some features would be broken, like recognising whether the system had booted successfully
- anthk 5y agoEven back in the BIOS days Linux overrode lots of BIOS stuff such as partition size limits once it booted.
- tremon 5y agocan efivarfs still be accessed after booting with efi=noruntime? If so, I might add that on my systems and see if anything breaks.
- mjg59 5y agoNo, all runtime services are gone. You don't /strictly/ need them in order to boot - most Linux distributions will install a loader in the fallback path and the firmware will run it even if there are no boot entries.