lkml.org 
[lkml]   [2016]   [Sep]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Date
SubjectRe: [PATCH] fs/proc/kcore.c: Omit kernel text area for hardened usercopy feature
On Tue, Sep 6, 2016 at 12:41 PM, Andi Kleen <andi@firstfloor.org> wrote:
>
> I suspect it's more than just /proc/kcore, there could be also
> legitimate cases to read kernel text from /dev/mem or /dev/kmem

Yes, that's probably true. Although I suspect that we should just say
that user-copy hardening is incompatible with /dev/kmem and
!STRICT_DEVMEM.

At least Fedora seems to have

CONFIG_DEVMEM=y
# CONFIG_DEVKMEM is not set
CONFIG_STRICT_DEVMEM=y

which should mean that you already should not be able to access normal
RAM using /dev/[k]mem - ie it's purely for legacy X server kind of
situations.

So we could just make HARDENED_USERCOPY force those settings. It's
not like you should ever have anything else in any situation where you
care about security *anyway*, so...

Linus

\
 
 \ /
  Last update: 2016-09-17 09:58    [W:0.053 / U:0.064 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site