Messages in this thread | | | From | Pali Rohár <> | Subject | dell-smm-hwmon: security problems | Date | Wed, 8 Jun 2016 11:57:22 +0200 |
| |
Hello!
Mario wrote me about two I think security problems in dell-smm-hwmon driver and I would like to ask you, how to fix them.
1) File /proc/i8k (exists only when kernel is compiled with CONFIG_I8K) exports DMI_PRODUCT_SERIAL and it can be read by ordinary user, without root permission. Normally DMI_PRODUCT_SERIAL can be read from sysfs file /sys/class/dmi/id/product_serial but only by root user.
2) Via /proc/i8k ordinary user can set fan speed. This is because how "restricted" parameter and variable works. Setting fan speed by normal non-root user can be dangerous, e.g. malicious application under user "nobody" could take control of fans.
Do you have idea how to fix these problems? Just to note that /proc/i8k has stable kernel ABI and changing it will break all existing i8k* applications. But /proc/i8k is there only for old legacy laptops (year 2000).
There is module parameter "restricted" with default value false and description: "Allow fan control if SYS_ADMIN capability set". Current code do:
case I8K_SET_FAN: if (restricted && !capable(CAP_SYS_ADMIN)) return -EPERM;
For me description is a bit ambiguous. What about setting "restricted" by default to true and updating description to something like this?
"Disallow fan control when SYS_ADMIN capability is not set (default: 1)"
-- Pali Rohár pali.rohar@gmail.com [unhandled content-type:application/pgp-signature] | |