lkml.org 
[lkml]   [2000]   [Jul]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Date
SubjectRe: Does this help explain better?? ATA/IDE Thread
In <8ldooq$29g$1@cesium.transmeta.com> H. Peter Anvin (hpa@zytor.com) wrote:
> Followup to: <Pine.LNX.4.10.10007212041090.15902-100000@master.linux-ide.org>
> By author: Andre Hedrick <andre@linux-ide.org>
> In newsgroup: linux.dev.kernel
>>
>> Everyone
>>
>> I am talking about attempting to invoke unknown vender specific commands
>> They do comply with the SPEC but are not part of the SPEC.
>> Since I do not have the priviledge of knowing these facts, but know they
>> exist. You can not allow a rouge driver attempt to invoke these commands.
>>

> A rogue driver can always do this by writing straight to the
> interface. I think a more serious issue is: what about a *buggy*
> drivers? However, what I am a bit unclear of is the following: will
> this patch prevent me from writing a driver which issues legitimate
> vendor-specific commands to control vendor-specific aspects of a
> particular piece of hardware?

This patch affects only some ioctls (there are some other fixes as weel,
bit "shield" part of it is exactly that).

> If so, that would be a very bad thing. However, if this patch is there to
> prevent buggy programs from issuing known-to-be-damaging commands by accient,
> then that is a Good Thing[TM].

It's other way around: it's patch to allow ONLY know-to-be-good commands
(like DISABLE_SEAGATE or EXABYTE_ENABLE_NEST) so equivalent command for WD
will be rejected while DISABLE_SEAGATE can be sent even to IBM HDD.

> I personally would have to agree with the people that say this isn't a
> security issue, but I *do* believe that protecting buggy programs (we
> never have any of those, right?) from causing permanent damage to the
> hardware is a very useful thing.

Not exactly. As Linus said it's a LOT of band-aids to avoid the "obvious"
holes. You know where to find such stuff.




-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:57    [W:0.075 / U:1.260 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site