lkml.org 
[lkml]   [2013]   [Sep]   [5]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    SubjectRe: [PATCH V3 03/11] x86: Lock down IO port access when module security is enabled
    From
    Date
    Sigh.  That capability really is fscked up.

    Matthew Garrett <matthew.garrett@nebula.com> wrote:
    >On Wed, 2013-09-04 at 20:52 -0700, H. Peter Anvin wrote:
    >> On 09/03/2013 04:50 PM, Matthew Garrett wrote:
    >> > IO port access would permit users to gain access to PCI
    >configuration
    >> > registers, which in turn (on a lot of hardware) give access to MMIO
    >register
    >> > space. This would potentially permit root to trigger arbitrary DMA,
    >so lock
    >> > it down by default.
    >> >
    >> > Signed-off-by: Matthew Garrett <matthew.garrett@nebula.com>
    >>
    >> Seriously... just deny CAP_SYS_RAWIO to any system in secure mode.
    >
    >No. CAP_SYS_RAWIO blocks things that we don't want blocked (x86
    >microcode updates, various disk ioctls, *device firmware uploads* and a
    >few others) - the semantics just don't match. We could relax those
    >permissions, but then we'd potentially break someone else's security
    >considerations.

    --
    Sent from my mobile phone. Please pardon brevity and lack of formatting.


    \
     
     \ /
      Last update: 2013-09-05 19:41    [W:2.447 / U:0.032 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site