Messages in this thread | | | Subject | Re: Flames over -- Re: Which is simpler? (Was Re: [Suspend2-devel] Re: [ 00/10] [Suspend2] Modules support.) | From | Johannes Berg <> | Date | Mon, 13 Feb 2006 13:12:56 +0100 |
| |
On Sun, 2006-02-12 at 13:28 -0500, Kyle Moffett wrote:
> /me reads spec. *sigh* Whatever idiocy-committee wrote that spec was > clearly either smoking crack or living in a fantasy-world (or both). > An arbitrary unrestricted DMA bus is a massive and painfully obvious > security hole. Can somebody _please_ shoot the guy that came up with > that brilliant idea? At least it looks like it's not available if > the firewire modules aren't loaded, which means that you can prevent > that sort of attack, and my laptop luckily doesn't load those modules > at boot just to save a bit of memory.
might not help since your firmware turns on the firewire port to enable booting from firewire disks.
> Even still, that's just a > terrible idea. Is there any practical way to restrict DMA and make > FireWire secure?
load the modules with phys_dma=0
johannes [unhandled content-type:application/pgp-signature] | |