How to create a UEFI read only variable?

Question

On an EFI system that boots GRUB2, I want to create a read-only EFI variable. Is this possbile?

Thanks, Mat

Answer 1

According to Uefi Specification 2.7 there is a straight forward way of creating a read-only UEFI variable post ExitBootServices() by not providing EFI_VARIABLE_NON_VOLATILE attribute.

See Chapter '8.2 Variable Services' SetVariable() description:

Once ExitBootServices() is performed, only variables that have EFI_VARIABLE_RUNTIME_ACCESS and EFI_VARIABLE_NON_VOLATILE set can be set with SetVariable(). Variables that have runtime access but that are not nonvolatile are read-only data variables once ExitBootServices() is performed.

See also Chapter '8.2 Variable Services' GetVariable() Related Definitions:

//*******************************************************
// Variable Attributes
//*******************************************************
#define EFI_VARIABLE_NON_VOLATILE 0x00000001

Answer 2

According to UEFI Specification 2.5 there is no straight forward way of creating read-only UEFI variable.

Expecting result can be achieved by using variables with Attributes: EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS and EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS.

According to chapter 7.2 (SetVariable description part) of UEFI Spec 2.5:

(...) An attempt to delete a variable created with the EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS or EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS attribute for which the prescribed AuthInfo validation fails or when called using DataSize of zero will fail with an EFI_SECURITY_VIOLATION status.

According to chapter 7.2.1 (Using the EFI_VARIABLE_AUTHENTICATION_2 descriptor), after long procedure describing variable update process:

The driver shall update the value of the variable only if all of these checks pass. If any of the checks fails, firmware must return EFI_SECURITY_VIOLATION.

Concluding, it is impossible to delete or modify variable, that was created using *_WRITE_ACCESS attributes, without authentication. GetVariable will return correct value indicating in attributes that returned variable requires authentication before update or delete. For more information please read UEFI Spec 2.5 chapter 7.2.1 and 7.2.2.