lkml.org 
[lkml]   [2006]   [Dec]   [31]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH] Open Firmware device tree virtual filesystem
    I made all the changes Pekka suggested, except:

    > + security = strncmp(propname, "security-", 9) == 0;
    >> + len = 0;
    >
    > Redundant assignment, no?
    >
    >> + if (!security)
    >> + (void)callofw("getproplen", 2, 1, node,
    >> propname, &len);
    >
    That assignment turns out not to be redundant. If a security variable
    is recognized, you want the length to be 0 so as not to expose the
    password. In that case the following "getproplen" call won't be executed.

    That logic was adapted from the existing file fs/proc/devtree.c . It
    turns out that the code there has a bug: You really want to look for
    just "security-password" ; there is no need to, and good reasons not to,
    suppress the length of "security-mode" and "security-#badlogins". (Good
    OFW implementations won't leak the password length anyway, so check is
    only needed as a workaround).

    I have rewritten the code for clarity and correctness thusly:

    if (strcmp(propname, "security-password") == 0) {
    len = 0; /* Don't leak password length */
    } else {
    callofw("getproplen", 2, 1, node, propname, &len);
    }



    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2006-12-31 19:59    [W:0.031 / U:29.600 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site