Commit d0a1865c authored by Nicholas Bishop's avatar Nicholas Bishop Committed by Ard Biesheuvel
Browse files

efi/esrt: Allow ESRT access without CAP_SYS_ADMIN 



Access to the files in /sys/firmware/efi/esrt has been restricted to
CAP_SYS_ADMIN since support for ESRT was added, but this seems overly
restrictive given that the files are read-only and just provide
information about UEFI firmware updates.

Remove the CAP_SYS_ADMIN restriction so that a non-root process can read
the files, provided a suitably-privileged process changes the file
ownership first. The files are still read-only and still owned by root
by default.

Signed-off-by: default avatarNicholas Bishop <nicholasbishop@google.com>
Signed-off-by: default avatarArd Biesheuvel <ardb@kernel.org>
parent d86ff333

drivers/firmware/efi/esrt.c

+0 −4
Original line number Diff line number Diff line
@@ -95,10 +95,6 @@ static ssize_t esre_attr_show(struct kobject *kobj, 
	struct esre_entry *entry = to_entry(kobj);

	struct esre_attribute *attr = to_attr(_attr);



	/* Don't tell normal users what firmware versions we've got... */

	if (!capable(CAP_SYS_ADMIN))

		return -EACCES;



	return attr->show(entry, buf);

}