lkml.org 
[lkml]   [2016]   [Jun]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Subjectdell-smm-hwmon: security problems
Date
Hello!

Mario wrote me about two I think security problems in dell-smm-hwmon
driver and I would like to ask you, how to fix them.

1) File /proc/i8k (exists only when kernel is compiled with CONFIG_I8K)
exports DMI_PRODUCT_SERIAL and it can be read by ordinary user, without
root permission. Normally DMI_PRODUCT_SERIAL can be read from sysfs file
/sys/class/dmi/id/product_serial but only by root user.

2) Via /proc/i8k ordinary user can set fan speed. This is because how
"restricted" parameter and variable works. Setting fan speed by normal
non-root user can be dangerous, e.g. malicious application under user
"nobody" could take control of fans.

Do you have idea how to fix these problems? Just to note that /proc/i8k
has stable kernel ABI and changing it will break all existing i8k*
applications. But /proc/i8k is there only for old legacy laptops (year
2000).

There is module parameter "restricted" with default value false and
description: "Allow fan control if SYS_ADMIN capability set". Current
code do:

case I8K_SET_FAN:
if (restricted && !capable(CAP_SYS_ADMIN))
return -EPERM;

For me description is a bit ambiguous. What about setting "restricted"
by default to true and updating description to something like this?

"Disallow fan control when SYS_ADMIN capability is not set (default: 1)"

--
Pali Rohár
pali.rohar@gmail.com
[unhandled content-type:application/pgp-signature]
\
 
 \ /
  Last update: 2016-06-08 12:21    [W:0.059 / U:0.440 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site