"bootctl install" outputs some warnings about /efi mount point and random seed file in the terminal

General system EndeavourOS installation
1

I needed to recreate my systemd-boot’s EFI boot entry in an oldish system converted from Grub.

I did a sudo bootctl install and I got the output here below:

Copied "/usr/lib/systemd/boot/efi/systemd-bootx64.efi" to "/efi/EFI/systemd/systemd-bootx64.efi".
Copied "/usr/lib/systemd/boot/efi/systemd-bootx64.efi" to "/efi/EFI/BOOT/BOOTX64.EFI".
⚠️ Mount point '/efi' which backs the random seed file is world accessible, which is a security hole! ⚠️
⚠️ Random seed file '/efi/loader/random-seed' is world accessible, which is a security hole! ⚠️
Random seed file /efi/loader/random-seed successfully refreshed (32 bytes).
Created EFI boot entry "Linux Boot Manager".

I have done a quick search in www but I haven’t found anything related to these warnings.

Does anyone know what these are about and how I could fix it?

drwxr-xr-x 8 root root 4096 Jan 1 1970 efi

ls -al /efi/loader/
total 24
drwxr-xr-x 3 root root 4096 Aug  1 22:27 .
drwxr-xr-x 8 root root 4096 Jan  1  1970 ..
drwxr-xr-x 2 root root 4096 Jun 16 19:22 entries
-rwxr-xr-x 1 root root    6 Sep 15  2022 entries.srel
-rwxr-xr-x 1 root root   71 Apr 26 20:47 loader.conf
-rwxr-xr-x 1 root root   32 Aug  1 22:27 random-seed
2 
sudo chmod o-rwx /efi/loader/random-seed
sudo chmod o-rwx /efi
1 Like
3

Thank you so much @dalto for the swift reply!

I executed the two chmod commands.
I ran the bootctl install once again to test.
I’m still getting:

⚠️ Mount point '/efi' which backs the random seed file is world accessible, which is a security hole! ⚠️
⚠️ Random seed file '/efi/loader/random-seed' is world accessible, which is a security hole! ⚠️

What am I missing?

4

What does ls -ld /efi show?

5 
$ ls -ld /efi
drwxr-xr-x 8 root root 4096 Jan  1  1970 /efi

It seems that the chmod command didn’t change any permissions?

6

Hahaha…it is because it is fat32.

You need to change the permissions in /etc/fstab and remount it.

Maybe add fmask=0137,dmask=0027 to options.

4 Likes
7

:man_facepalming:t4:

Obvious now when you mention it :sweat_smile:

Will do right away and report back.

8

In /etc/fstab

UUID=5C1D-26F4 /efi vfat rw,relatime,fmask=0137,dmask=0027,errors=remount-ro 0 2

$ sudo bootctl install 
Copied "/usr/lib/systemd/boot/efi/systemd-bootx64.efi" to "/efi/EFI/systemd/systemd-bootx64.efi".
Copied "/usr/lib/systemd/boot/efi/systemd-bootx64.efi" to "/efi/EFI/BOOT/BOOTX64.EFI".
Random seed file /efi/loader/random-seed successfully refreshed (32 bytes).
Created EFI boot entry "Linux Boot Manager".

You did it! Again! :wink: :smile:
Thank you @dalto!

Marked it solved :white_check_mark:

4 Likes
9

This fixed for me too, thanks :+1:

1 Like
10

This topic was automatically closed 2 days after the last reply. New replies are no longer allowed.