Messages in this thread | | | Date | Thu, 14 Jul 2011 13:37:20 -0700 | From | "H. Peter Anvin" <> | Subject | Re: [PATCH 2/2] x86: Allow disabling of sys_iopl, sys_ioperm |
| |
On 07/14/2011 01:34 PM, Mike Waychison wrote: > In some build environments, it is useful to allow disabling of IO > accesses to hardware, without having to rely on CAP_SYS_RAWIO (which is > already overloaded to mean many other things). One way that userland > has access to IO accesses is via the iopl(2) and ioperm(2) system calls. > > Allow disabling of these system calls from ever being available via a > configuration option, X86_SYS_IOPL. This is implemented by simply > stubbing out the system calls and having them return ENOSYS when their > functionality is disabled. > > Note that we default this option to 'y', so that existing kernel configs > will continue to support sys_iopl and sys_ioperm as before. >
Wouldn't it be more useful for this to be a sysctl? In particular, like many similar things it probably should be a lockable sysctl (three states: enabled, disabled, and locked-disabled).
Making it a compile-time option I'm very skeptical to.
-hpa
| |